I had a missing data from a certain date and time range. How would i re-ingest the data into splunk from a UF.
Below is the inputs.conf
[monitor:///app/java/servers/app/log/app.log.2023-11-12]
index = app_logs
ignoreOlderThan = 10d
disabled = false
sourcetype = javalogs
Its missing data from Nov-11 00:05 till Nov-12 13:00 so how would i just reinject the data only for that certain data/time period.
It just one log file for a day although we have some events so how would i regest only the missing data for the time period and please let me know the config.
A common way to re-ingest data is by using the splunk add oneshot command. Splunk will re-ingest everything in the file, however, without regard to events that were previously indexed. To ingest only missing events, I would copy the file and remove the events that you don't want to read in again.