- Splunk Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- How to reindex the same source
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How to reindex the same source
I tried to reindex the following windows directories using "Monitor" from input data.
d:\logs\appx
d:\logs\appy
d:\logs\trac
the above folders contain 3-4 log files.
I gave specific sourcetype for each data input folder.
Splunk indexed "appx" and "trac" folders but not "appy" folder. I am unable to see the events from the search results for appy, but I can see Splunk showed count of appy directory under files & directories. I deleted the datainputs and sourcetype and added appy with different sourcetype and index but still I can't see the events in the search results.
I tried to add crcsalt but I don't have permission to edit the input.conf file.
How can I reindex the appy directory
NOTE: Splunk indexing files under appy individually but not entire appy directory.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Is it possible for you to run the following on the forwarder ./splunk cmd btool inputs list monitor?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I am not fetching data from remote servers to run that forwarder command.
Those directories are on splunk local server. (I mean that "appy" directory is located on D drive and splunk installed on C drive) no other servers connected using universal forwarder..
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I can index the individual file under that appy directory but not entire appy directory. Wondering why its not indexing because the logs in appy are similar to other folder logs but different application.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What timerange are you searching? Have you tried alltime?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I am searching for "all time" only . Interesting thing is it is indexing individual files but not that directory.
Introducing the Splunk Community Dashboard Challenge!
Wondering How to Build Resiliency in the Cloud?
Updated Data Management and AWS GDI Inventory in Splunk Observability
