In a cluster environment, you should already have a copy of the searchable bucket in another indexer provided you have at least SF=2. Enable the indexer cluster maintenance mode Stop the indexer in question 3. a. Move the broken journal file away (while splunkd turned off) to another place or b. Delete the bucket Start the indexer in question Disable the indexer cluster maintenance mode. ... View more