I ran |delete on some data (oops!). How do I get the universal forwarder to send the data to the indexers again?
I stopped the forwarder, installed another universal forwarder and configured inputs.conf to monitor only the files I ran |delete on and that worked. I then uninstalled the new forwarder and restarted the old one.
I didn't want to clear the fishbucket because I didn't want ALL of the data to be re-ingested and for some reason the forwarder to forget the specific files wasn't working for me.
Maybe not the best solution, but it worked.
I stopped the forwarder, installed another universal forwarder and configured inputs.conf to monitor only the files I ran |delete on and that worked. I then uninstalled the new forwarder and restarted the old one.
I didn't want to clear the fishbucket because I didn't want ALL of the data to be re-ingested and for some reason the forwarder to forget the specific files wasn't working for me.
Maybe not the best solution, but it worked.
Look at the answer on this page: https://answers.splunk.com/answers/72562/how-to-reindex-data-from-a-forwarder.html (look at the second section). It is an excellent write-up of what you need to know.
This is probably what you need:
$SPLUNK_HOME/var/lib/splunk/fishbucket
or selectively forgot a single file from the fishbucket
splunk cmd btprobe -d $SPLUNK_HOME/var/lib/splunk/fishbucket/splunk_private_db --file $FILE --reset
good luck
You need to clear the fishbucket out on the forwarder so it see's it as data it hasn't indexed yet. Option B would be to open the files and insert a single character near the top so it tricks the forwarder into thinking its a new file
https://www.splunk.com/blog/2008/08/14/what-is-this-fishbucket-thing.html