How can I trigger the re-indexing of a single file?

[hexx]

I would like to have Splunk re-index a specific file /logs/pubic_folder/noodles/log that it has already indexed on this system. I would rather not use splunk oneshot for this purpose. Is there a command that I can use to trigger the targeted re-indexing?

[jbsplunk · Accepted solution]

Yes, you can do this using the btprobe command. For details on the command see:

http://docs.splunk.com/Documentation/Splunk/latest/Troubleshooting/CommandlinetoolsforusewithSupport...

Here is an example from my instance:

bash-3.2# $SPLUNK_HOME/bin/splunk cmd $SPLUNK_HOME/bin/btprobe -d $SPLUNK_HOME/var/lib/splunk/fishbucket/splunk_private_db --file /path/to/file.log --reset
key=0x4f69f1d1bbdaa678 scrc=0xd44cedea0b197d75 sptr=3915499 fcrc=0xa4aa5ab5c0bd4186 flen=0 mdtm=1342710532 wrtm=1343059242
Record (key 0x4f69f1d1bbdaa678) reset.