Splunk Enterprise

Is there any way to selectively re-index data?

responsys_cm
Builder

I know that by deleting the fishbucket index Splunk will re-index everything. Is there a way to selectively re-index data for a particular source or sourcetype?

Thx.

Craig

Tags (1)
1 Solution

_d_
Splunk Employee
Splunk Employee

Yes, you can use btprobe command in the forwarder (or wherever the data source is located) to reset the (fishbucket) entry for a given key or particular file in fishbucket's btree.

There is more info here: http://docs.splunk.com/Documentation/Splunk/4.3.2/Troubleshooting/CommandlinetoolsforusewithSupport#...

Hope it helps.

View solution in original post

_d_
Splunk Employee
Splunk Employee

Yes, you can use btprobe command in the forwarder (or wherever the data source is located) to reset the (fishbucket) entry for a given key or particular file in fishbucket's btree.

There is more info here: http://docs.splunk.com/Documentation/Splunk/4.3.2/Troubleshooting/CommandlinetoolsforusewithSupport#...

Hope it helps.

responsys_cm
Builder

How do I figure out what the key is for a particular sourcetype or source?

0 Karma
Get Updates on the Splunk Community!

Splunk App for Anomaly Detection End of Life Announcment

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...