Have you thought about simply renaming the index and turning on data integrity control? After that you should be able to regenerate the hashes. If this isn't an option for you, you'll have to replay the historical data from your forwarders by clearing the fishbucket once pointed to the new index, if that data it still exists. https://answers.splunk.com/answers/28134/rename-an-index-in-4-1-8.html https://docs.splunk.com/Documentation/Splunk/7.0.1/Security/Dataintegritycontrol#Regenerate_hashes ... View more