I had to thaw data from index abc from 1 Dec 2019-30 Dec 2019
Steps performed:
1. Copied buckets into thaweddb folder
2. splunk rebuild bucket_name
3. Rolling restart indexer cluster
I reviewed the data in index=abc and noticed only 1 sourcetype events got thawed.
However, there are 4 more sourcetype listed in SourceType.data file bucket after rebuilding it.
Any suggestions why not all sourcetypes data got thawed ?
