While I wait for Splunk support to get back to me on my case, I'll pose the problem here.
After moving DB folders back into Thaweddb, I completed the needed steps from the 6.3.4 documentation to rebuild and restart the indexer.
http://docs.splunk.com/Documentation/Splunk/6.3.4/Indexer/Restorearchiveddata
Unfortunately, the events are still not searchable. What else can I try to get the events searchable?
↧
