Hello!
Our Customers' environment is a large pool of windows/linux servers with logs of many forms.
Sometimes when constructing props or other conf files I strongly need to reindex data. So I want to clean forwarder's fishbacket.
I don't have physical access to servers when forwarders installed no administrative privileges to do it remotely.
The procedure "./splunk stop -clean fishbacket- ./splunk start" is not for me. And I don't want to bother the customer with my "clean fishbacket script"
As far as I know I can use REST API calls to somehow manage forwarders. I exactly can reload UF and it works.
Can I use REST API to force UF to reindex?
Is there any other way to clean fishbacket in my case?
I think my situation is rather typical, so I believe the solution should exist.
Thanks a lot!
Use offline data indexed into a temporary testing index for build your props.conf, and only enable your forwarders on the real data once you have the settings correct. That way you won't need to frequently clean fishbuckets and reindex stuff.
Use offline data indexed into a temporary testing index for build your props.conf, and only enable your forwarders on the real data once you have the settings correct. That way you won't need to frequently clean fishbuckets and reindex stuff.
Uff.... That's the thing I started to do at the begining of my activities. I created TEMP index for test purposes, but then I abandoned it for quicker results.. Hurry is not a good thing.
Thanks a lot!