If an update is made to an attribute in inputs.

https://www.splunk.com/en_us/blog/tips-and-tricks/what-is-this-fishbucket-thing.html

" Every Splunk instance has a fishbucket index, except the lightest of hand-tuned lightweight forwarders, and if you index a lot of files it can get quite large. As any other index, you can change the retention policy to control the size via indexes.conf "

Reference https://community.splunk.com/t5/Archive/How-to-reindex-data-from-a-forwarder/td-p/93310