So we have lots of files -- one is created every day. We want to re-index this data. We have removed the data from the index but in order to re-index the old data we need to clear the fishbucket data.
Something like this:
./splunk cmd btprobe -d $SPLUNK_HOME/var/lib/splunk/fishbucket/splunk_private_db --file $FILE --reset
Has anyone got any ideas of how to reset large amounts of file using the btprobe tool (without individually resetting them)?
Perhaps wrap btprobe inside of a loop. See: https://answers.splunk.com/answers/542172/use-btprobe-reset-to-re-index-multiple-files.html