All sourcetypes not getting thawed

Getting Data In

I had to thaw data from index abc from 1 Dec 2019-30 Dec 2019

Steps performed:

1. Copied buckets into thaweddb folder

2. splunk rebuild bucket_name

3. Rolling restart indexer cluster

I reviewed the data in index=abc and noticed only 1 sourcetype events got thawed.

However, there are 4 more sourcetype listed in SourceType.data file bucket after rebuilding it.

Any suggestions why not all sourcetypes data got thawed ?

Get Updates on the Splunk Community!

Maintaining data integrity across security and analytics pipelines is an ongoing challenge. Data ...

Instrumentation is usually the last step or even an afterthought when building out a project. The feature ...

Federated Search for Cisco Security Analytics and Logging (SAL) is now generally available as part of the ...

Join the Conversation