@lguinn told us at Searching _fishbucket
-- Splunk no longer lets you look at the fishbucket index. You cannot manage the specific records. The format is not published and the files are kept in binary.
And it's from 2013 ; -) apparently it's not possible.
Hi Jeremiah, thanks for your reply
I just want to graph it using this comand: index="_thefishbucket" | timechart span=1h count by index
looking into the wiki it seems that something has to do with crcSalt in inputs.conf but I cannopt figure it out
is for study purposes 😃