Monitoring Splunk

How can I re-index license-usage.log?

tkwaller_2
Communicator

Hello

Someone prior to me had set the license master to forward logs to the wrong hosts so when I fixed it I have no historical data for license usage.
Whats the best way to fix this?

Thanks for the assistance!

0 Karma
1 Solution

CarsonZa
Contributor

one of the following is what i use

  • modify the first line of the files to reindex, by default splunk checks the first 256 chars of a file to differentiate them. If you had a simple comment on the first line it will reindex it

  • change the crcSalt, create a new input for a new folder, add all the correct sourcetypes, etc... using a static string that will force a one time reindexing. crcSalt= REINDEXMEPLEASE

https://answers.splunk.com/answers/72562/how-to-reindex-data-from-a-forwarder.html

View solution in original post

CarsonZa
Contributor

one of the following is what i use

  • modify the first line of the files to reindex, by default splunk checks the first 256 chars of a file to differentiate them. If you had a simple comment on the first line it will reindex it

  • change the crcSalt, create a new input for a new folder, add all the correct sourcetypes, etc... using a static string that will force a one time reindexing. crcSalt= REINDEXMEPLEASE

https://answers.splunk.com/answers/72562/how-to-reindex-data-from-a-forwarder.html

tkwaller_2
Communicator

My only concern was with the data that was already there but it backfilled/reindexed just fine

Thanks again

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...