There is no way to undelete the data. If you still have the original data, you can reindex the file with the Splunk oneshot command, examples http://answers.splunk.com/questions/684/after-fixing-props-conf-how-to-re-index-the-same-files-using-the-new-settings and sort-of docs: http://www.splunk.com/base/Documentation/4.1.4/Admin/CLIadmincommands Splunk normally remembers files it has already seen and won't reindex them (even if you rename them) but oneshot bypasses this mechanism. ... View more