Splunk Search

Index Data Retrieve

aquillius
New Member

I deleted data on my index using code "index = asr_local | delete "

but when I added new data on my database, i can't retrieve it on my index. when i search index = asr_local, no results found..

What seems to be the problem and how can i retrieve again data?

Tags (1)
0 Karma

MuS
SplunkTrust
SplunkTrust

Hi aquilius,

the delete command does not delete data from the index, the events will just no longer show as results but are still in the index. Also Splunk still knows what was indexed and therefor does not re-index the same data again .... unless you do some work.

The radical method is to clean the fishbucket index. That will remove the memory of every files, be warned it will re-index all data.

  • on an indexer splunk clean eventdata -index _fishbucket
  • on a forwarder by removing the folder $SPLUNK_HOME/var/lib/splunk/fishbucket

You could selectively forgot a single file from the fish bucket like this:

splunk cmd btprobe -d $SPLUNK_HOME/var/lib/splunk/fishbucket/splunk_private_db --file $FILE --reset

You could manually re-index each file with the oneshot option

splunk add oneshot "/path/to/my/file.log" -sourcetype mysourcetype

You could modify the first line of the files to re-index, by default Splunk checks the first 256 chars of a file to differentiate them. If you had a simple comment on the first line it wil reindex it

You could change the crcSalt, create a new input for a new folder, add all the correct sourcetypes, etc... add the option crcSalt=<SOURCE> then move or copy the files to be re-index to the folder.

hope this helps ...

cheers, MuS

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...