Getting Data In

How to delete all indexed data and reindex from all the forwarders in our environment?

ericlarsen
Path Finder

We're still building out our Splunk environment (pre-implementation) and have been forwarding data from lots of different data sources. We're still working on correctly defining sourcetypes via inputs.conf.

Once we have inputs.conf fully defined, I plan to delete all indexed data using the ./splunk clean eventdata –index command.

I then want to reindex all the data from all the forwarders. Do I need to do anything to make this happen (once the data has been deleted from the indexes)?

Do I need to add crcSalt = to each stanza in inputs.conf? Do I also need to run the './splunk clean all' command on each forwarder to clear out the _fishbucket?

Thanks.

Tags (3)
0 Karma

harsmarvania57
Ultra Champion

Hi,

You need to clean fishbucket on forwarder.

1.) Stop splunkforwarder
2.) Remove fishbucket or clean fishbucket
3.) Start splunkforwarder

Thanks,
Harshil

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...