All sourcetypes not getting thawed

Getting Data In

I had to thaw data from index abc from 1 Dec 2019-30 Dec 2019

Steps performed:

1. Copied buckets into thaweddb folder

2. splunk rebuild bucket_name

3. Rolling restart indexer cluster

I reviewed the data in index=abc and noticed only 1 sourcetype events got thawed.

However, there are 4 more sourcetype listed in SourceType.data file bucket after rebuilding it.

Any suggestions why not all sourcetypes data got thawed ?

Get Updates on the Splunk Community!

AI is one of the biggest topics in the market today, and for security teams, its value goes far beyond the ...

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

[REGISTER HERE] This thread is for the Community Office Hours session on Detection Engineering Office Hours: ...

Join the Conversation