All sourcetypes not getting thawed

Getting Data In

I had to thaw data from index abc from 1 Dec 2019-30 Dec 2019

Steps performed:

1. Copied buckets into thaweddb folder

2. splunk rebuild bucket_name

3. Rolling restart indexer cluster

I reviewed the data in index=abc and noticed only 1 sourcetype events got thawed.

However, there are 4 more sourcetype listed in SourceType.data file bucket after rebuilding it.

Any suggestions why not all sourcetypes data got thawed ?

Get Updates on the Splunk Community!

When you run Edge Processor in hybrid mode, alongside a Splunk heavy forwarder on the same host, two questions ...

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...

Winning Over the Boss: Your Pass to .conf26 conf26 is going to be here before you know it. If don't already ...

Join the Conversation