All sourcetypes not getting thawed

Getting Data In

I had to thaw data from index abc from 1 Dec 2019-30 Dec 2019

Steps performed:

1. Copied buckets into thaweddb folder

2. splunk rebuild bucket_name

3. Rolling restart indexer cluster

I reviewed the data in index=abc and noticed only 1 sourcetype events got thawed.

However, there are 4 more sourcetype listed in SourceType.data file bucket after rebuilding it.

Any suggestions why not all sourcetypes data got thawed ?

Get Updates on the Splunk Community!

At the .conf26 AI Agent Buildathon, Splunk users turned their operational expertise into working AI agents ...

AI is compressing attacker timelines and pushing SOC teams beyond human capacity thresholds. The next SOC ...

Windows event logs—from Security auditing and Sysmon to PowerShell script blocks—form the operational backbone ...

Join the Conversation