I configured my server logs in splunk.
When I saw the logs in splunk I realized I set up some wrong properties in props.conf.
Now I rectify the properties in props.conf and restart server.
Somehow I still see the same logs on splunk front end, as they were before I rectified the issue in conf file.
Is there a way to know, if Splunk is picking logs from NEW INDEX ?
It seems it is picking logs from the index the got created the first time around.
Since props.conf
lives on the indexer, it means that if you make changes then it will only affect new data being indexed, so it will not work retroactively. The only way to make changes retroactively is at search time
To solve your problem, I would reccomend deleting the data from the index and reindexing the new data with the correct props.conf
configuration
To remove data from the index
sourcetype=YOUR_SOURCETYPE | delete
To Reindex your new data
Do a oneshoot to reindex your data, go to your forwarder and to the splunk/bin
folder
./splunk add oneshot /full/path/to/file -sourcetype mysourcetype -index myindex -host myhostparam
Your changes will only affect new events. Anything indexed before you changed props.conf will continue to have the wrong properties. Are you sure you're looking at new data?