Hello,
I deleted the redundant logs from an index with "delete" command. Now, I would like to update the metadata info. Is it possible?
From the link , the delete command doesn't update the metadata. There is no direct method to update the metadata. The workaround will be do a re-indexing of the data which in most cases is not feasible.
http://answers.splunk.com/answers/2031/remove-hostname-from-the-metadata.html
From the link , the delete command doesn't update the metadata. There is no direct method to update the metadata. The workaround will be do a re-indexing of the data which in most cases is not feasible.
http://answers.splunk.com/answers/2031/remove-hostname-from-the-metadata.html
Just let the "wrong" buckets age out, it'll fix itself over the retention period for that index.