What is the easiest way to make changes for data parsing and then re-load all of the data that has already been indexed. We do not want to clear / delete any of the events that have already been captured but we would just like to re-index all of the data that has already ran through the indexing process.
You can either use the splunk add oneshot command, or if you are using the Splunk file monitor, you can perform a clean of the fishbucket index on the input instance.
