Re-indexing multiple files using btprobe

tc641 · ‎08-23-2017

So we have lots of files -- one is created every day. We want to re-index this data. We have removed the data from the index but in order to re-index the old data we need to clear the fishbucket data.

Something like this:
./splunk cmd btprobe -d $SPLUNK_HOME/var/lib/splunk/fishbucket/splunk_private_db --file $FILE --reset

Has anyone got any ideas of how to reset large amounts of file using the btprobe tool (without individually resetting them)?

jmeyers_splunk · ‎10-17-2017

Perhaps wrap btprobe inside of a loop. See: https://answers.splunk.com/answers/542172/use-btprobe-reset-to-re-index-multiple-files.html

Re-indexing multiple files using btprobe

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Automating Threat Operations and Threat Hunting with Recorded Future

Join the Conversation

Re-indexing multiple files using btprobe

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Automating Threat Operations and Threat Hunting with Recorded Future