Deployment Architecture

rebuild operation for multiple thawed buckets

sudhir7
Explorer

I am trying to restore data from frozen buckets to Splunk indexer.

If I restart the indexer after rebuilding every bucket, the indexer works fine. But if I restart the indexer after rebuilding multiple buckets, the indexer is getting hanged.

My question is if someone knows how to do the rebuild operation for multiple buckets instead of having to do it one bucket at a time?

Get Updates on the Splunk Community!

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

 Prepare to elevate your security operations with the powerful upgrade to Splunk Enterprise Security 8.x! This ...

Get Early Access to AI Playbook Authoring: Apply for the Alpha Private Preview ...

Passionate about security automation? Apply now to our AI Playbook Authoring Alpha private preview ...

Reduce and Transform Your Firewall Data with Splunk Data Management

Managing high-volume firewall data has always been a challenge. Noisy events and verbose traffic logs often ...