Data rolled to frozen directory is coming as inflight data and it showing size of it as 0.
There are few details about inflight-db as too why they happen basically Splunk says that they are created when Splunk is writing from warm to cold but not much more than that.
So lets say that Splunk is writing buckets and its like 100 GB worth of buckets if lets say you had 3 indexers with buckets that were 3 months old and you forced all your buckets from these 3 indexers to move to cold.
As long as they had write access to your storage should there even be inflight dbs? or is that too much to write at once and Splunk is like nah I dont think so. And therefore writes some data but the rest it just make some error log and calls it a day.
So is there a limit as to how much can be writen to cold at one time?
If it is writing and that write gets interupted then why does it see that and just resume where it left off to complete the transfer?
I know there are logs but seems to me it should be like watching a movie with internet I should be able to pause and then resume when I'm ready or better yet if 100 buckets start writing and some technical issue happens at 1/4 or halfway then that bucket writing should either cancel full stop and tell me in plain language or pause and resume when connection is back up.
