Getting Data In

I ran |delete on data. Why won't the forwarder resend?

matstap
Communicator

I ran |delete on some data (oops!). How do I get the universal forwarder to send the data to the indexers again?

0 Karma
1 Solution

matstap
Communicator

I stopped the forwarder, installed another universal forwarder and configured inputs.conf to monitor only the files I ran |delete on and that worked. I then uninstalled the new forwarder and restarted the old one.
I didn't want to clear the fishbucket because I didn't want ALL of the data to be re-ingested and for some reason the forwarder to forget the specific files wasn't working for me.
Maybe not the best solution, but it worked.

View solution in original post

0 Karma

matstap
Communicator

I stopped the forwarder, installed another universal forwarder and configured inputs.conf to monitor only the files I ran |delete on and that worked. I then uninstalled the new forwarder and restarted the old one.
I didn't want to clear the fishbucket because I didn't want ALL of the data to be re-ingested and for some reason the forwarder to forget the specific files wasn't working for me.
Maybe not the best solution, but it worked.

0 Karma

chrisyounger
SplunkTrust
SplunkTrust

Look at the answer on this page: https://answers.splunk.com/answers/72562/how-to-reindex-data-from-a-forwarder.html (look at the second section). It is an excellent write-up of what you need to know.

This is probably what you need:

  • on a forwarder by removing the folder $SPLUNK_HOME/var/lib/splunk/fishbucket

or selectively forgot a single file from the fishbucket

  • splunk cmd btprobe -d $SPLUNK_HOME/var/lib/splunk/fishbucket/splunk_private_db --file $FILE --reset

good luck

0 Karma

skoelpin
SplunkTrust
SplunkTrust

You need to clear the fishbucket out on the forwarder so it see's it as data it hasn't indexed yet. Option B would be to open the files and insert a single character near the top so it tricks the forwarder into thinking its a new file

https://www.splunk.com/blog/2008/08/14/what-is-this-fishbucket-thing.html

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...