what happens to "|delete"d events when a bucket is thawed?

[w199284]

I have buckets with hidden (deleted) events that are frozen. I want to thaw these buckets. Will I need to re-delete these events?

[pruthvikrishnap]

Hi,

You will have to specify a setting to archive data from frozen, else Splunk will delete all the data.
http://docs.splunk.com/Documentation/Splunk/6.4.0/Indexer/Setaretirementandarchivingpolicy#Archive_d...
http://docs.splunk.com/Documentation/Splunk/6.4.0/Indexer/Automatearchiving

Let me know if this helps.

[richgalloway]

The OP already has frozen data.