Why does the "splunk rebuild" command require restarting Splunk?

[yutaka1005]

I had thought that splunk have to restart when configuration file such as "*.conf" was changed.

However, if I did "splunk rebuild" command, I need to restart splunk.
Why is it necessary to restart splunk even though it is just reloading the archived data again?
Is processing of rebuild different from usual data acquisition?.

I think that it is difficult to publish internal processing, so I would be pleased if you can tell me type of case it will be necessary to restart.

[danielsofoulis · Accepted solution]

Archived/Fozen data is not searchable in Splunk as you're probably aware.

When you rebuild the data is loaded to the nominated thawed directory. This process is different from the initial indexing. When Splunk is restarted the search flags are reallocated by splunkd which is why you must restart.

Hope this helps.

[yutaka1005]

Thank you very polite commentary.

Thanks to your comment, I could understand that I have to restart Splunk to index the rebuilt data.