Sounds like what you are looking for is the equivalent of the backfill command which is exists for summary indexing. However that doesn't cover you in situations when in a distributed environment and you have a single indexer down for a period of time. During that time you will be exporting partial results and Splunk just continues on as if everything's all good. The only App that splunk has which deals with this type of failure is the hadoop connect app. When it runs a search to export it will not write out the data to hadoop unless all indexers are up. If even one indexer is down is reruns the search until ALL indexers are up. I really wish Splunk incorporated type of check into more of their Apps/Scheduler. ... View more

yes, they should restart. ... View more

This answer was helpful, thanks; but didn't really answer my question which I will do here: A precise but long description of PCRE regex is at http://www.pcre.org/pcre.txt. To understand regular expressions as transformation functions, the output of a regular expression is: - the input string - minus substrings matched by the regex - substituted with output from a FORMAT argument, and substrings 'captured' in the regex referenced either with $n or the names of capture subgroups. The tool at http://gskinner.com/RegExr/ and the doc above helped me figure this out. I hope I'm right! ... View more