We're still building out our Splunk environment (pre-implementation) and have been forwarding data from lots of different data sources. We're still working on correctly defining sourcetypes via inputs.conf.
Once we have inputs.conf fully defined, I plan to delete all indexed data using the ./splunk clean eventdata –index
command.
I then want to reindex all the data from all the forwarders. Do I need to do anything to make this happen (once the data has been deleted from the indexes)?
Do I need to add crcSalt = to each stanza in inputs.conf? Do I also need to run the './splunk clean all' command on each forwarder to clear out the _fishbucket?
Thanks.
Hi,
You need to clean fishbucket on forwarder.
1.) Stop splunkforwarder
2.) Remove fishbucket or clean fishbucket
3.) Start splunkforwarder
Thanks,
Harshil