How to move frozen buckets back to warm?

[capqwerty]

We have changed how we do things, intending to move to smartcache shortly.

We have a lot of frozen data we would like to put back into circulation in anticipation of making it readily available to be retrieved when required.

I understand we can utilise a frozen folder. However, would like to pull it back into our cache pre the move to smartcache. Allowing Splunk to manage it via the smartcache storage.

Is there a way\method that this can be achieved?

[gcusello]

Hi @capqwerty,

if they are outside the retention period you cannot put again on line, the only way is the frozen path.

I'm not sure that changing the retention period for that index it's possible to put them again on line, I think that you can use only frozen path.

Ciao.

Giuseppe