Re-indexing multiple files using btprobe

tc641 · ‎08-23-2017

So we have lots of files -- one is created every day. We want to re-index this data. We have removed the data from the index but in order to re-index the old data we need to clear the fishbucket data.

Something like this:
./splunk cmd btprobe -d $SPLUNK_HOME/var/lib/splunk/fishbucket/splunk_private_db --file $FILE --reset

Has anyone got any ideas of how to reset large amounts of file using the btprobe tool (without individually resetting them)?

jmeyers_splunk · ‎10-17-2017

Perhaps wrap btprobe inside of a loop. See: https://answers.splunk.com/answers/542172/use-btprobe-reset-to-re-index-multiple-files.html

Re-indexing multiple files using btprobe

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Mastering Threat Intelligence in ES 8.5, Splunk AI Assistant v2, and More from Splunk ...

Break the Build: Inside the KubeDoom Lounge at .conf26

Splunk Auto Ingestion Parallel Pipeline Scaling

Join the Conversation

Re-indexing multiple files using btprobe

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Mastering Threat Intelligence in ES 8.5, Splunk AI Assistant v2, and More from Splunk ...

Break the Build: Inside the KubeDoom Lounge at .conf26

Splunk Auto Ingestion Parallel Pipeline Scaling