All sourcetypes not getting thawed

Getting Data In

I had to thaw data from index abc from 1 Dec 2019-30 Dec 2019

Steps performed:

1. Copied buckets into thaweddb folder

2. splunk rebuild bucket_name

3. Rolling restart indexer cluster

I reviewed the data in index=abc and noticed only 1 sourcetype events got thawed.

However, there are 4 more sourcetype listed in SourceType.data file bucket after rebuilding it.

Any suggestions why not all sourcetypes data got thawed ?

Get Updates on the Splunk Community!

We’ve discovered a bug that affected the auto-clear of Synthetic Detectors in the Splunk Synthetic Monitoring ...

Remember Splunk Community member Tom Kopchak? If you caught the first episode of our Smartness interview ...

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud? Learn how unique features like ...