I confirm I had the same issue (using Splunk 8.0.5), after a restore thawed buckets were not searchable. Checking with the REST API call the flag frozen was equal to 1. I solved restarting the Master Node, even if the REST API call still  give the frozen flag equal to 1 (but lot more information are showed after the restart), the thawed buckets are now searchable. ... View more

Starting from @jaime_ramirez  solution I have added a portion of SPL to check whether or not your sourcetypes are going into which datamodels: | datamodel | rex field=_raw "\"modelName\"\s*\:\s*\"(?<modelName>[^\"]+)\"" | search NOT modelName IN (Splunk_CIM_Validation) | fields modelName | table modelName | map maxsearches=40 search="tstats summariesonly=true count from datamodel=$modelName$ by sourcetype | eval modelName=\"$modelName$\"" | append [| search index=_internal source=*license_usage.log type="Usage" pool="herePutYourLicensePool" | eval sourcetype = st | stats count by sourcetype | eval modelName="removeit", count=0 | fields sourcetype modelName count] | xyseries sourcetype modelName count | fillnull value="N" | fields - removeit   ... View more

@richgalloway thanks for your feedback We currently have (per site): HPE Bladesystem using  VMware ESXi and RHEL OS 4 Blade Blade 1: 2 SH (2 VM with 20 physical CPU core + 64 GB RAM each) Blade 2: 1 Indexer ( dedicated VM with 2x20 physical core CPU + 96GB RAM each ) Blade 3: 1 Indexer ( dedicated VM with 2x20 physical core CPU + 96GB RAM each ) Blade 4: 1 Indexer ( dedicated VM with 2x20 physical core CPU + 96GB RAM each ) 2 x Fiber Channel Modules 8 ports (each port 16Gb/s) Blade 1-4 connect to 4 ports on Fiber Channel Modules 1 to SAN 1 Blade 1-4 connect to 4 ports on Fiber Channel Modules 2 to SAN 2 Each Fiber Channel Module is virtualized Storage SAN Hitachi G1000 (All Flash SSD) Each Indexer has a 13TB dedicated LUN (space already reserved) The LUN is mounted as a vmdk Thanks a lot, Edoardo ... View more

That's a good suggestion, just wanted to add what we discovered. During the data migration we have found out that even increasing the following setting in the Master Node it was not speeding up the replication process. max_peer_build_load As written here: https://docs.splunk.com/Documentation/Splunk/latest/Indexer/Takeapeeroffline#:~:text=If%20the%20search%20factor%20is,remaining%20set%20of%20searchable%20copies. This is due for the following reason: The search factor. This determines how quickly the cluster can convert non-searchable copies to searchable. If the search factor is at least 2, the cluster can convert non-searchable copies to searchable by copying index files to the non-searchable copies from the remaining set of searchable copies. If the search factor is 1, however, the cluster must convert non-searchable copies by rebuilding the index files, a much slower process. (For information on the types of files in a bucket, see Data files.) The time required to rebuild the index files on a non-searchable bucket copy containing 4GB of rawdata depends on a number of factors such as the size of the resulting index files, but 30 minutes is a reasonable approximation to start with. Rebuilding index files is necessary if the search factor is 1, meaning that there are no copies of the index files available to stream. A non-searchable bucket copy consisting of 4GB rawdata can grow to a size approximating 10GB once the index files have been added. As described earlier, the actual size depends on numerous factors. Therefore copying tsidx files via network is much more faster than rebuilding them at the target peer. Saying that, increasing the max_peer_build_load could be bounded by your network bandwidth and so if you are already using all the available bandwidth (or you have intentionally limited it to avoid issues within your network infrastructure) you will not have any benefit. Instead, in a scenario in which with the default value (max_peer_build_load = 2) you are not sending data at the maximum available network speed, increasing that value can significantly improve the replication process. ... View more

I also see that the solution is present 2 times. Would it be feasible to come back to the older layout (or something close to it)? ... View more

Where is it possible to  suggest for improvements on the new UI? Is this thread the correct place? Thanks a lot, Edoardo ... View more

In the meanwhile I found this, if executed from the Monitoring Console it reports all the Splunk Servers: | rest /services/server/status count=0 splunk_server=* | dedup splunk_server | table splunk_server Now need to check if the same REST call can be done from the Search Head to the Monitoring Console (that in my deployment is in a different server). ... View more

@soutamo  Thank you, I know how to do a SPL REST call, the point is that I don't know which is (or which are) the REST calls to be done to list all the servers within a Splunk deployment ... View more