It's possible to hide some data so that has been already indexed with the delete command, this makes it no longer searchable.
http://www.splunk.com/base/Documentation/4.1.5/SearchReference/Delete
http://www.splunk.com/base/Documentation/4.1.5/Admin/RemovedatafromSplunk
It isn't reversible (and off by default), so measure twice, cut once.
You can force reindexing by a couple of different methods. You could reindex everything using a splunk clean eventdata on your forwarders. You could force reindexing of specific files by copying them to $SPLUNK_HOME/var/log/splunk, though the paths will be a bit different. You can tell splunk to index a particular file regardless of the duplication logic with the oneshot input method: splunk help add oneshot
Lastly, a bit dirty, you could get somewhat sneaky and defeat splunk's redundancy checking. If you modify the first 256 bytes of your logfiles, eg by inserting a single character of whitespace at the start of them, it will reindex those files, assuming they are totally new.
... View more