Getting Data In

Is it possible to re-index file data for a specific source or sourcetype in Splunk?

rameshlpatel
Communicator

Hi,

I have requirement where i wants to re-index file data for specific sourcetype or source ?

Is it possible to do in splunk ?

strive
Influencer

For cleaning and re-indexing refer this link

http://answers.splunk.com/answers/1203/why-wont-splunk-re-index-my-data

In this link Yann has given 3 nice options to re-index a file. Just like my earlier comment renaming is one of the options

http://answers.splunk.com/answers/46780/reset-splunkforwarder-to-re-read-file-from-beginning

strive
Influencer

You want to clean the data and re-index or you just want to re-index?

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Or you can use Splunk CLI oneshot to add the data again.

See this
http://docs.splunk.com/Documentation/Splunk/6.1.3/Data/MonitorfilesanddirectoriesusingtheCLI

strive
Influencer

Yes it is possible. Change the filename and try. If filename is your source then change file modification time and try.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...