I have a log file that was |delete
'd from the index using search. I want the file back in the index. I did several steps of adding and removing the file as a Splunk input and restarting the machine's splunk. It just won't come back. Is there an easy way to |undelete
?
There is no way to undelete
the data. If you still have the original data, you can reindex the file with the Splunk oneshot
command, examples http://answers.splunk.com/questions/684/after-fixing-props-conf-how-to-re-index-the-same-files-using... and sort-of docs: http://www.splunk.com/base/Documentation/4.1.4/Admin/CLIadmincommands
Splunk normally remembers files it has already seen and won't reindex them (even if you rename them) but oneshot
bypasses this mechanism.
There is no way to undelete
the data. If you still have the original data, you can reindex the file with the Splunk oneshot
command, examples http://answers.splunk.com/questions/684/after-fixing-props-conf-how-to-re-index-the-same-files-using... and sort-of docs: http://www.splunk.com/base/Documentation/4.1.4/Admin/CLIadmincommands
Splunk normally remembers files it has already seen and won't reindex them (even if you rename them) but oneshot
bypasses this mechanism.