Restore reduced buckets for a index in a cluster

[season88481]

Hi everyone,

I am following this Splunk doc regarding how to restore a reduce buckets: https://docs.splunk.com/Documentation/Splunk/latest/Indexer/Reducetsidxdiskusage#Restore_reduced_buc...

My questions is how to restore reduced buckets for an entire index?

Will the rebuild buckets be replicated to other peer nodes?

Cheers,
S

[s2_splunk · Accepted solution]

Please refer to this for a command that scopes a rebuild to a whole index. 

My assumption is that all buckets still lifecycle-managed by Splunk (which is true for COLD) will be subject to cluster master fixup to meet RF/SF, but you will have to run the rebuild on every peer in your cluster (while it is taken OFFLINE), so - in theory - RF should still be met and full index rebuild will happen as needed as part of normal cluster operations.