Hi Max, use this command to check if the file status of the file has been reset
splunk cmd btprobe -d $SPLUNK_DB/fishbucket/splunk_private_db --file <file> --reset
The response from this command is an indicator that the status for the file has been reset. Again, a restart of the forwarder is required for Splunk to then ingest that file anew.
if this assist you, please upvote.