Splunk Search

Reindex a file on 3000 machines

daniel333
Builder

All,

I indexed a 30-line config file off all our Linux hosts. But accidentally used the wrong source-type and index. So I deleted the delete with | delete. Now I need to reindex the file now that I have the correct inputs.conf configured. I thought it would as simple as adding

crcsalt= and I'd be set. But it's not working. Any ideas?

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You can change the init CRC length in your inputs.conf, that will invalidate all fishbucket entries you previously had.

martin_mueller
SplunkTrust
SplunkTrust

A 30-line config file should be long enough for a 256b CRC - that's just eight byte per line.

Note, configuration keys are case sensitive. Make sure you used crcSalt and initCrcLength as specified in inputs.conf.

0 Karma

gjanders
SplunkTrust
SplunkTrust
0 Karma

daniel333
Builder

Tried this with no luck. I suspect since this file is very tiny that the CRC init might not play a factor but I am honestly not sure. Any other tricks?

0 Karma
Get Updates on the Splunk Community!

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more with ITSI’s ...

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more! Faster Time to ValueManaging and ...

New Release | Splunk Enterprise 9.3

Admins and Analyst can benefit from:  Seamlessly route data to your local file system to save on storage ...

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...