Splunk Enterprise Certified Admin Practice Test

What two actions do you need to take on the universal forwarder to re-index data?

1. Restart forwarder and reset index

2. Reset fishbucket and stop forwarder

3. Reset fishbucket and restart forwarder

4. Clear cache and restart services

The correct answer is: Reset fishbucket and restart forwarder

Re-indexing data in a universal forwarder requires specific actions to ensure that the data is processed correctly by Splunk. The correct approach involves resetting the fishbucket and restarting the forwarder. The fishbucket is a special file that tracks which data has already been indexed by the forwarder. Resetting the fishbucket essentially clears this record, allowing the forwarder to reprocess the data as if it were being ingested for the first time. This action is crucial because it enables the forwarder to ignore its previous indexing status and treat the existing data as new. Restarting the forwarder afterward is important because it ensures that all changes, including the reset of the fishbucket, take effect. Upon restart, the forwarder will begin to re-index data from the source, applying the updated indexing rules. Other options incorporating actions not necessary for re-indexing, such as stopping the forwarder (which would halt all data transfer), or clearing unrelated caches, do not fulfill the requirements for re-indexing in a streamlined manner. Thus, the combination of resetting the fishbucket and restarting the forwarder is the correct sequence to successfully re-index data in a universal forwarder.