Splunk Enterprise

How to reindex a small file?

Anantha123
Communicator

Hi All,

My file is not reindexing though I used below settings in my inputs configuration file  . File is very small (300 char) and wont change often,  want file to reindex daily .  Kindly help .

crcSalt = <SOURCE> 
initCrcLength = 256

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

If the file doesn't change then Splunk won't re-index it.  You'll have to delete the fishbucket to force Splunk to re-index the file.

splunk cmd btprobe -d /opt/splunkforwarder/var/lib/splunk/fishbucket/splunk_private_db --file <small file> --reset
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...