What is the process of removing thawed data from Splunk?
The documentation doesn't mention it http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Restorearchiveddata
However other threads in answers just suggest stopping the indexer and deleting the data -- is there a CLI way of doing this or is there a way of doing this without stopping my indexer?
As per the the link above link you shared, Based on my experience, you don't need to restart indexer, just removing the thawed buckets will do.
"You can put archived data in the thawed directory for as long as you need it. When the data is no longer needed, simply delete it or move it out of thawed."
As per the the link above link you shared, Based on my experience, you don't need to restart indexer, just removing the thawed buckets will do.
"You can put archived data in the thawed directory for as long as you need it. When the data is no longer needed, simply delete it or move it out of thawed."