Getting Data In

How to delete all indexed data and reindex from all the forwarders in our environment?

ericlarsen
Path Finder

We're still building out our Splunk environment (pre-implementation) and have been forwarding data from lots of different data sources. We're still working on correctly defining sourcetypes via inputs.conf.

Once we have inputs.conf fully defined, I plan to delete all indexed data using the ./splunk clean eventdata –index command.

I then want to reindex all the data from all the forwarders. Do I need to do anything to make this happen (once the data has been deleted from the indexes)?

Do I need to add crcSalt = to each stanza in inputs.conf? Do I also need to run the './splunk clean all' command on each forwarder to clear out the _fishbucket?

Thanks.

Tags (3)
0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

Hi,

You need to clean fishbucket on forwarder.

1.) Stop splunkforwarder
2.) Remove fishbucket or clean fishbucket
3.) Start splunkforwarder

Thanks,
Harshil

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...