All,
Is there a way to make a Universal Forwarder reindex all its inputs?
thanks
-Daniel
Hi daniel333,
btool
is used to view or validate Splunk config files.
Probably btprobe
was meant in the previous answer, which enables you to remove fish bucket information for a specific file.
Easiest way to re-index all inputs on a universal forwarder is to delete the fish bucket index while Splunk UF is stopped:
$SPLUNK_HOME/bin/splunk stop
rm -rf $SPLUNK_HOME/var/lib/splunk/fishbucket
$SPLUNK_HOME/bin/splunk start
Splunk will re-create the fish bucket index and immediately re-index all the inputs on your universal forwarder, so watch out for your license usage 😉
cheers, MuS
A sensational explanation at How to reindex data from a forwarder
404 -- not found
Reset the fishbucket
with btprobe
:
http://docs.splunk.com/Documentation/Splunk/6.4.1/Troubleshooting/CommandlinetoolsforusewithSupport
is there a way to clear fishbucket without reindexing? In one of the old UF , fishbucket file has occupied complete disk space and i need to clear the file to run Splunk again.