https://community.splunk.com/t5/Deployment-Architecture/Is-there-a-way-to-not-lose-all-the-events-in-this-bucket-with-a/m-p/618723#M26264 <P>thank you&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/213957">@richgalloway</a>&nbsp; for your answer.</P><P>yes when I use the backup it is not corrupted. I guess my question didn't make any sense.&nbsp;</P><P>&nbsp;</P> Fri, 28 Oct 2022 13:05:39 GMT aatik5u 2022-10-28T13:05:39Z https://community.splunk.com/t5/Deployment-Architecture/Is-there-a-way-to-not-lose-all-the-events-in-this-bucket-with-a/m-p/618249#M26262 <P>Hello everyone!</P> <P>I am working on test environment where I only have one Splunk instance. I edited on the journal.zst file in one of my buckets (I have a buckup) just to test the data integrity, so now it's corrupted. my question is, is there a way to not lose all the events in this bucket ? I tried fsck and rebuild but the bucket is still corrupted with data integrity check being unsuccessful which is normal.</P> <P>I'm not sure if it's possible in the real world to face such an issue, but m curious to know what would the best strategy be.</P> <P>any help would be appreciated <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span>&nbsp;</P> Fri, 28 Oct 2022 14:14:23 GMT https://community.splunk.com/t5/Deployment-Architecture/Is-there-a-way-to-not-lose-all-the-events-in-this-bucket-with-a/m-p/618249#M26262 aatik5u 2022-10-28T14:14:23Z https://community.splunk.com/t5/Deployment-Architecture/Is-there-a-way-to-not-lose-all-the-events-in-this-bucket-with-a/m-p/618265#M26263 <P>Have you tried restoring the backup?</P> Tue, 25 Oct 2022 16:36:35 GMT https://community.splunk.com/t5/Deployment-Architecture/Is-there-a-way-to-not-lose-all-the-events-in-this-bucket-with-a/m-p/618265#M26263 richgalloway 2022-10-25T16:36:35Z https://community.splunk.com/t5/Deployment-Architecture/Is-there-a-way-to-not-lose-all-the-events-in-this-bucket-with-a/m-p/618723#M26264 <P>thank you&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/213957">@richgalloway</a>&nbsp; for your answer.</P><P>yes when I use the backup it is not corrupted. I guess my question didn't make any sense.&nbsp;</P><P>&nbsp;</P> Fri, 28 Oct 2022 13:05:39 GMT https://community.splunk.com/t5/Deployment-Architecture/Is-there-a-way-to-not-lose-all-the-events-in-this-bucket-with-a/m-p/618723#M26264 aatik5u 2022-10-28T13:05:39Z