I have some zip files that I need to reindex after cleaning the target index and refining the props.
I cannot get splunk to re-ingest them no matter what--even after cleaning the fishbucket.
Here is the TailingProcessor state for one of them:0 10239974 /opt/splunkdata/tmp/cm/2014.11 0.00 finished reading
While percent is 0, it has finished reading it. As far as I can tell from other Answers, this is not supposed to happen.
Btprobe is no help:
splunk cmd btprobe -d /opt/splunk/var/lib/splunk/fishbucket/splunk_private_db --file /opt/splunkdata/tmp/cm/2014.11/2014001.zip
Using logging configuration at /opt/splunk/etc/log-cmdline.cfg.
record not found
So can't reset it that way. Then I took the radical step of cleaning the fishbucket..still no joy.
I can't see any way around this; and furthermore it looks like some kind of bug--oneshots aren't working either.
Anyone know a solution? Version is 6.4.2
Thanks!
↧