Just for my interest.
Hope some one can answer my question and with thanks. ^^
Can i remove or add the warm database in real time without stop splunk process?
Yes, but it might take a few minutes or so for Splunk to see the data.
Just make sure that the unique identifier of the bucket is unique to the folder.
Thanks for your quick response.
Another question, need to restart splunk process to take effect?