Howto make Splunk re-index all data
Posted by Brandon Burton on August 19th, 2009 filed in productivityI wanted a customer’s Splunk install to re-index all the JBoss logs as log4j to see if it would get “smarter” about the contents, which it didn’t, but, if you want to tell Splunk to do that, you do
/opt/splunk/bin/splunk stop
/opt/splunk/bin/splunk clean eventdata -index _thefishbucket
/opt/splunk/bin/splunk start
Leave a Comment