Not sure the best way to go about this. We had an index that originally had a 30 day retention that they wanted extended to 1 year after it had been running for awhile. It was also originally setup to to collect new data going forward but they now also want all the historical data pulled into splunk as this was replacing a different tool. How do I restore the already retentioned data and collect the old data that was originally outside of the window of what we wanted pulled in? I've already adjusted the retention period and removed the ignoreolder=7d from the config. Am I just better off rebuilding the whole thing from scratch?   [monitor://<Path>] index=<Appname> sourcetype=chr crcSalt = <SOURCE> [<Appname>] homePath = volume:hot/$_index_name coldPath = volume:cold/$_index_name summaryHomePath = volume:summaries/$_index_name thawedPath = /opt/splunk/data/thawed/$_index_name enableTsidxReduction = false maxDataSize = auto_high_volume frozenTimePeriodInSecs = 31536000 ... View more