I'm having problems getting splunk to re-index data. Here are the steps I've taken:
Created a data input file from a shared folder on another computer indexed into test index checked the data, made sure everything was correct disabled the data input deleted data in the test index by using | delete in the CLI, stopped splunk ran splunk clean eventdata -index test splunk start
changed the data input to send to main index started enabled data input
I was expecting the data to be re-indexed, but this hasn't happened.