Getting Data In

How can I trigger the re-indexing of a single file?

hexx
Splunk Employee
Splunk Employee

I would like to have Splunk re-index a specific file /logs/pubic_folder/noodles/log that it has already indexed on this system. I would rather not use splunk oneshot for this purpose. Is there a command that I can use to trigger the targeted re-indexing?

Tags (2)
1 Solution

jbsplunk
Splunk Employee
Splunk Employee

Yes, you can do this using the btprobe command. For details on the command see:

http://docs.splunk.com/Documentation/Splunk/latest/Troubleshooting/CommandlinetoolsforusewithSupport...

Here is an example from my instance:

bash-3.2# $SPLUNK_HOME/bin/splunk cmd $SPLUNK_HOME/bin/btprobe -d $SPLUNK_HOME/var/lib/splunk/fishbucket/splunk_private_db --file /path/to/file.log --reset
key=0x4f69f1d1bbdaa678 scrc=0xd44cedea0b197d75 sptr=3915499 fcrc=0xa4aa5ab5c0bd4186 flen=0 mdtm=1342710532 wrtm=1343059242
Record (key 0x4f69f1d1bbdaa678) reset.

View solution in original post

jbsplunk
Splunk Employee
Splunk Employee

Yes, you can do this using the btprobe command. For details on the command see:

http://docs.splunk.com/Documentation/Splunk/latest/Troubleshooting/CommandlinetoolsforusewithSupport...

Here is an example from my instance:

bash-3.2# $SPLUNK_HOME/bin/splunk cmd $SPLUNK_HOME/bin/btprobe -d $SPLUNK_HOME/var/lib/splunk/fishbucket/splunk_private_db --file /path/to/file.log --reset
key=0x4f69f1d1bbdaa678 scrc=0xd44cedea0b197d75 sptr=3915499 fcrc=0xa4aa5ab5c0bd4186 flen=0 mdtm=1342710532 wrtm=1343059242
Record (key 0x4f69f1d1bbdaa678) reset.
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...