Getting Data In

force UF to reindex remotedly

ribentrop
Explorer

Hello!
Our Customers' environment is a large pool of windows/linux servers with logs of many forms.
Sometimes when constructing props or other conf files I strongly need to reindex data. So I want to clean forwarder's fishbacket.
I don't have physical access to servers when forwarders installed no administrative privileges to do it remotely.
The procedure "./splunk stop -clean fishbacket- ./splunk start" is not for me. And I don't want to bother the customer with my "clean fishbacket script"
As far as I know I can use REST API calls to somehow manage forwarders. I exactly can reload UF and it works.
Can I use REST API to force UF to reindex?
Is there any other way to clean fishbacket in my case?
I think my situation is rather typical, so I believe the solution should exist.
Thanks a lot!

0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Use offline data indexed into a temporary testing index for build your props.conf, and only enable your forwarders on the real data once you have the settings correct. That way you won't need to frequently clean fishbuckets and reindex stuff.

View solution in original post

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Use offline data indexed into a temporary testing index for build your props.conf, and only enable your forwarders on the real data once you have the settings correct. That way you won't need to frequently clean fishbuckets and reindex stuff.

0 Karma

ribentrop
Explorer

Uff.... That's the thing I started to do at the begining of my activities. I created TEMP index for test purposes, but then I abandoned it for quicker results.. Hurry is not a good thing.
Thanks a lot!

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...