Restore frozen data

[TISKAR]

Hello,

I have this INFO message:

INFO BucketMover - will attempt to freeze bkt="/opt/splunk/var/lib/splunk/idx/db/rb_1588633961_1588517402_205_9C902924-4080-41E4-B824-9B4D721A8889" reason=" maxTotalDataSize"

I want re-index the bucket removed but i can't find it, for example i run:

find /opt/splunk/ -name "rb_1588633961_1588517402_205_9C902924-4080-41E4-B824-9B4D721A8889"

but no result.

Can i index data removed after the max size reashed.

Thank you.

[richgalloway]

By default, buckets that are "frozen" are deleted. That will change if either of coldToFrozenScript or coldToFrozenDir are set in indexes.conf.  Those attributes will tell you where to find the frozen buckets.

To learn how to restore ("thaw") frozen buckets, see https://docs.splunk.com/Documentation/Splunk/8.0.5/Indexer/Restorearchiveddata