Why I cant reindex my log data after two consecutive cleaning of index?

[shariinPH]

Hi all,

Im having trouble with re indexing my logs after i did twice index clean up.

I have here my inputs.conf in my forwarder

[monitor://G:\OpData\Operation\Uploadrb\...\*.TXT]
disabled = false
index = mynld_readbill
sourcetype = rbill_ul_mru
ignoreOlderThan = 30d
recursive=true
crcSalt=<SOURCE>
_TCP_ROUTING=mynlddev

for my props.conf in indexer

[rbill_ul_mru]
DATETIME_CONFIG = NONE
MAX_TIMESTAMP_LOOKAHEAD = 150
MAX_DAYS_HENCE = 15
NO_BINARY_CHECK = 1
SHOULD_LINEMERGE = false
pulldown_type = 1

why can't I re index the logs?
i already did the splunk clean eventdata -index mynld_readbill in my indexers CLI and splunk clean all in my forwarder
Is there anything that I need to configure?
please send me some help dear splunkers.

[satishsdange · Accepted solution]

You should clean fishbucket as well on UF. Please see below -

~/splunkforwarder/bin/splunk stop
rm -r ~/splunkforwarder/var/lib/splunk/fishbucket ~/splunkforwarder/bin/splunk start 

[shariinPH]

hi @satishsdange , im using windows OS for this. can you help me?

[schose]

same on windows.. delete c:\Program Files\SplunkUniversalForwarder\var\lib\splunk\fishbucket\ , restart the forwarder and data will come in again.

[shariinPH]

@schose and @satishsdange.. will this affect my other indexes? for example i just want to clean a specific index. what should i do ?

[schose]

Deleting the fishbucket will be like reinstall the universal forwarder. All local data will be indexed again. if you index your data do different indexex you have to be careful as this end up in double events.

Regards,

Andreas

[shariinPH]

thanks Andreas , but is it okay if i want to clean everything and i will change the names of my indexes then proceed with the indexing?