Dear All,
We have a clustered-index Splunk 6.3 system where the administrators set the frozen time to a very low value (7 days) as they thought that this was the only amount of time required for the data retention, so the data that is over 7 days old is all gone from the index. The first thing that we did was to increase the frozen data time period and so the data is not being aged out any more, gladly.
Gladly, though, somehow, the RAW data files for the last month have been discovered and we need to re-index this data.
I am guessing that the fishbucket on the Forwarder will stop the Forwarder from sending the data and I have found this rather useful Answer which tells me that I can use the btprobe command to delete the entry from the fishbucket for an individual file:
https://answers.splunk.com/answers/54070/btprobe-and-re-indexing-data.html
Which shows me:
./btprobe -d SPLUNK_HOME/var/lib/splunk/fishbucket/splunk_private_db --file /var/log/access.log --reset
However, if I run this for a file on the Forwarder, will the Indexers pick this up again and re-index the data, as the data has already been aged out and therefore, there is no record of it or do I need to do the same on the Indexers as well?
