https://community.splunk.com/t5/Deployment-Architecture/Re-indexing-cold-data/m-p/140112#M23063 <P>We have some year old cold data that has been restored from tape. We would like to re-index and search this data. </P> <P>What is the best way to do this?</P> <P>I have looked at the "oneshot" method but it appears to be designed for a single log file. This is an entire "colddb" directory from an indexer.</P> <P>Thanks!</P> Wed, 23 Apr 2014 14:46:57 GMT loatswil 2014-04-23T14:46:57Z https://community.splunk.com/t5/Deployment-Architecture/Re-indexing-cold-data/m-p/140112#M23063 <P>We have some year old cold data that has been restored from tape. We would like to re-index and search this data. </P> <P>What is the best way to do this?</P> <P>I have looked at the "oneshot" method but it appears to be designed for a single log file. This is an entire "colddb" directory from an indexer.</P> <P>Thanks!</P> Wed, 23 Apr 2014 14:46:57 GMT https://community.splunk.com/t5/Deployment-Architecture/Re-indexing-cold-data/m-p/140112#M23063 loatswil 2014-04-23T14:46:57Z https://community.splunk.com/t5/Deployment-Architecture/Re-indexing-cold-data/m-p/140113#M23064 <P>You do not need to reindex buckets, just make them searchable.<BR /> Use the same procedure than restoring frozen buckets : copy them to your thawedPath location.<BR /> see <A href="http://docs.splunk.com/Documentation/Splunk/6.0.3/Indexer/Restorearchiveddata">http://docs.splunk.com/Documentation/Splunk/6.0.3/Indexer/Restorearchiveddata</A></P> <P>Remark : you could copy them back to the coldPath, but the retention rules (size and time) will immediately apply, and the buckets can be deleted. So the thawedPath is the best solution.</P> Wed, 23 Apr 2014 16:25:09 GMT https://community.splunk.com/t5/Deployment-Architecture/Re-indexing-cold-data/m-p/140113#M23064 yannK 2014-04-23T16:25:09Z