https://community.splunk.com/t5/Getting-Data-In/Removing-thawed-data/m-p/271859#M52218 <P>As per the the link above link you shared, Based on my experience, you don't need to restart indexer, just removing the thawed buckets will do.</P> <PRE><CODE>"You can put archived data in the thawed directory for as long as you need it. When the data is no longer needed, simply delete it or move it out of thawed." </CODE></PRE> Fri, 27 May 2016 14:33:17 GMT somesoni2 2016-05-27T14:33:17Z https://community.splunk.com/t5/Getting-Data-In/Removing-thawed-data/m-p/271858#M52217 <P>What is the process of removing thawed data from Splunk?<BR /> The documentation doesn't mention it <A href="http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Restorearchiveddata">http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Restorearchiveddata</A><BR /> However other threads in answers just suggest stopping the indexer and deleting the data -- is there a CLI way of doing this or is there a way of doing this without stopping my indexer?</P> Fri, 27 May 2016 13:28:05 GMT https://community.splunk.com/t5/Getting-Data-In/Removing-thawed-data/m-p/271858#M52217 alekksi 2016-05-27T13:28:05Z https://community.splunk.com/t5/Getting-Data-In/Removing-thawed-data/m-p/271859#M52218 <P>As per the the link above link you shared, Based on my experience, you don't need to restart indexer, just removing the thawed buckets will do.</P> <PRE><CODE>"You can put archived data in the thawed directory for as long as you need it. When the data is no longer needed, simply delete it or move it out of thawed." </CODE></PRE> Fri, 27 May 2016 14:33:17 GMT https://community.splunk.com/t5/Getting-Data-In/Removing-thawed-data/m-p/271859#M52218 somesoni2 2016-05-27T14:33:17Z