Splunk version 7.3.6
When I run
| dbinspect index=*
I receive the expected output but only for hot/warm buckets. Is this normal behavior? Is there any way to obtain the status on cold buckets using dbinspect? I have confirmed that there are in fact cold buckets in the expected directories and that they are searchable by Splunk.
For anyone else who finds themselves with this issue. The fix is to search | dbinspect over All Time.
For anyone else who finds themselves with this issue. The fix is to search | dbinspect over All Time.