Deployment Architecture

Re-indexing aged-out data process?

BlueSocket
Communicator

Dear All,

We have a clustered-index Splunk 6.3 system where the administrators set the frozen time to a very low value (7 days) as they thought that this was the only amount of time required for the data retention, so the data that is over 7 days old is all gone from the index. The first thing that we did was to increase the frozen data time period and so the data is not being aged out any more, gladly.

Gladly, though, somehow, the RAW data files for the last month have been discovered and we need to re-index this data.

I am guessing that the fishbucket on the Forwarder will stop the Forwarder from sending the data and I have found this rather useful Answer which tells me that I can use the btprobe command to delete the entry from the fishbucket for an individual file:

https://answers.splunk.com/answers/54070/btprobe-and-re-indexing-data.html

Which shows me:

./btprobe -d SPLUNK_HOME/var/lib/splunk/fishbucket/splunk_private_db --file /var/log/access.log --reset

However, if I run this for a file on the Forwarder, will the Indexers pick this up again and re-index the data, as the data has already been aged out and therefore, there is no record of it or do I need to do the same on the Indexers as well?

Masa
Splunk Employee
Splunk Employee

Yes, after your run btprobe...-reset at UF, and restart the UF, without changing anything in inputs.conf at UF, UF re-monitor the file. Indexer does not know events were indexed in the past. So, indexer simply indexes any data coming from UF.

gcusello
SplunkTrust
SplunkTrust

Hi BlueSocket,
You could create a new monitor stanza to reindex only the old data using the crcSalt = <SOURCE> option in inputs.conf file and when you'll finish you can delete the stanza.
In this way you can rendex these data without modify fishbucket.
Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...