How do i re-ingest data from a particular source?

[sathiyasun]

I had a missing data from a certain date and time range. How would i re-ingest the data into splunk from a UF.

Below is the inputs.conf

[monitor:///app/java/servers/app/log/app.log.2023-11-12]
index = app_logs
ignoreOlderThan = 10d
disabled = false
sourcetype = javalogs

Its missing data from Nov-11 00:05 till Nov-12 13:00 so how would i just reinject the data only for that certain data/time period.

It just one log file for a day although we have some events so how would i regest only the missing data for the time period and please let me know the config.

sathiyasun_1-1700066977105.png

sathiyasun_0-1700066609304.png

[richgalloway]

A common way to re-ingest data is by using the splunk add oneshot command.  Splunk will re-ingest everything in the file, however, without regard to events that were previously indexed.  To ingest only missing events, I would copy the file and remove the events that you don't want to read in again.