Buckets ending .rbsentinel in the clustered COLD directory of index and 0 size

[splunkreal]

Hello guys,

what are .rbsentinel files on clustered indexers?

Could they conflict when thawing buckets if they have same bucket ID?

Thanks.

[splunkreal · Accepted solution]

Support:

- Restarting the indexer as we know it's normal to make the indexer aware of the new "built" bucket. At the same time Cluster master (if you query the indexers not directly is mandatory to be restarted as it contains the searchability list)
- rbsentinel with zero size are not important what is mandatory to is the starttime_endtime_CLUSTER_UID/FOLDER/filename.tar.gz which contains the essential to build the tsidx information