Deployment Architecture

Use btprobe reset to re-index multiple files

MedralaG
Communicator

I have the following files that are being monitored on a server with a universal forwarder.
/var/log/www1/secure.log
/var/log/www1/access.log
/var/log/www2/secure.log
/var/log/www2/access.log

Is there a way to use wildcards to get btprobe to reset and reindex the content of those files.
Keep in mind that the /var/log/ directory has other subfolders that are being monitored that I don't want to reset those, so purging the fishbucket folder is out of question.

0 Karma
1 Solution

woodcock
Esteemed Legend

Even if wildcards worked (there's no indication that they do), it would be too risky to use them; just do this from shell in bash:

for file in /var/log/www1/secure.log /var/log/www1/access.log /var/log/www2/secure.log /var/log/www2/access.log
do
    echo resetting $file...
    $SPLUNK_HOME/bin/splunk cmd btprobe -d  $SPLUNK_HOME/var/lib/splunk/fishbucket/splunk_private_db  --file $file --reset
done

View solution in original post

0 Karma

woodcock
Esteemed Legend

Even if wildcards worked (there's no indication that they do), it would be too risky to use them; just do this from shell in bash:

for file in /var/log/www1/secure.log /var/log/www1/access.log /var/log/www2/secure.log /var/log/www2/access.log
do
    echo resetting $file...
    $SPLUNK_HOME/bin/splunk cmd btprobe -d  $SPLUNK_HOME/var/lib/splunk/fishbucket/splunk_private_db  --file $file --reset
done
0 Karma
Get Updates on the Splunk Community!

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...