Re-indexing cold data

[loatswil]

We have some year old cold data that has been restored from tape. We would like to re-index and search this data.

What is the best way to do this?

I have looked at the "oneshot" method but it appears to be designed for a single log file. This is an entire "colddb" directory from an indexer.

Thanks!

[yannK · Accepted solution]

You do not need to reindex buckets, just make them searchable.
Use the same procedure than restoring frozen buckets : copy them to your thawedPath location.
see http://docs.splunk.com/Documentation/Splunk/6.0.3/Indexer/Restorearchiveddata

Remark : you could copy them back to the coldPath, but the retention rules (size and time) will immediately apply, and the buckets can be deleted. So the thawedPath is the best solution.