https://community.splunk.com/t5/Getting-Data-In/All-sourcetypes-not-getting-thawed/m-p/514606#M87195 <P>I had to thaw data from index abc from 1 Dec 2019-30 Dec 2019</P><P>Steps performed:</P><P>1.&nbsp; Copied buckets into thaweddb folder</P><P>2. splunk rebuild bucket_name</P><P>3. Rolling restart indexer cluster</P><P>I reviewed the data in index=abc and noticed only 1 sourcetype events got thawed.</P><P>However, there are 4 more sourcetype listed in SourceType.data file bucket after rebuilding it.</P><P>Any suggestions why not all sourcetypes data got thawed ?</P> Tue, 18 Aug 2020 06:41:31 GMT snigdhasaxena 2020-08-18T06:41:31Z https://community.splunk.com/t5/Getting-Data-In/All-sourcetypes-not-getting-thawed/m-p/514606#M87195 <P>I had to thaw data from index abc from 1 Dec 2019-30 Dec 2019</P><P>Steps performed:</P><P>1.&nbsp; Copied buckets into thaweddb folder</P><P>2. splunk rebuild bucket_name</P><P>3. Rolling restart indexer cluster</P><P>I reviewed the data in index=abc and noticed only 1 sourcetype events got thawed.</P><P>However, there are 4 more sourcetype listed in SourceType.data file bucket after rebuilding it.</P><P>Any suggestions why not all sourcetypes data got thawed ?</P> Tue, 18 Aug 2020 06:41:31 GMT https://community.splunk.com/t5/Getting-Data-In/All-sourcetypes-not-getting-thawed/m-p/514606#M87195 snigdhasaxena 2020-08-18T06:41:31Z