Script for finding frozen data by date range and restore them

Mehran_Safari — Mon, 12 Sep 2022 12:18:16 GMT

This is a script for finding frozen bucket files in time range you gave

It shows folders + size + start time and endtime of logs contains on each folder log + asks to unfrozen log

#!/bin/bash clear echo "############################" echo "##created.by mehran.safari##" echo "## 2022 ##" echo "############################" ############## echo -n " Enter index name to lookup:" read INAME #### FROZENPATH="/frozendata" echo " Default Splunk Frozen Indexes Path is "$FROZENPATH". is it ok? (y to continue or n to give new path):" read ANSWER3; case "$ANSWER3" in "y") echo -e "OK Deafult Frozen Index Path Selected.";; "n") echo -e "Enter NEW Frozen Index Path:"; read FROZENPATH;; esac #### find "$FROZENPATH/$INAME" -type d -iname "db_*" -print > "./frozendb.txt" echo -n " Enter starting date you need("MM/DD/YYYY HH:MM:SS"):" read SDATE echo -n " Enter end date you need("MM/DD/YYYY HH:MM:SS"):" read EDATE ############## BSDATE=$(date -d "$SDATE" +%s) BEDATE=$(date -d "$EDATE" +%s) ############# FILE='./frozendb.txt' while read line; do LOGSTART=`echo $line | cut -d "_" -f3`; LOGEND=`echo $line | cut -d "_" -f2`; if [[ $BSDATE -le $LOGEND && $BEDATE -gt $LOGSTART ]]; then echo -e "******************************" echo -e "Frozen Log Path You want: $line" HLOGSTART=`date -d @"$LOGSTART"` HLOGEND=`date -d @"$LOGEND"` LOGSIZE=`du -hs "$line" | cut -d "/" -f1` echo -e "*** this Bucket contains logs from: $HLOGSTART" echo -e "*** this Bucket contains logs to: $HLOGEND " echo -e "**** The Size Of This Log Is: $LOGSIZE" echo -e "$line" >> "./frozenmatched.txt" echo -e "******************************" #else #echo "not in data range you want: $line" fi done<$FILE ############ sudo rm -rf "./frozendb.txt" echo "Do you Want to Unfrozen this Logs?(y to copy): " read ANSWER FILE2='./frozenmatched.txt' INDEXPATH="/opt/splunk/var/lib/splunk" DST="$INDEXPATH/$INAME/thaweddb/" if [[ "$ANSWER" == "y" ]]; then echo " Default Destination is "$DST". is it ok? (y to continue or n to give new path):" read ANSWER2; case "$ANSWER2" in "y") echo -e "OK Deafult Destination Selected.";; "n") echo -e "Enter NEW Destination Path:"; read DST;; esac while read line2; do sudo cp -R "$line2" "$DST" echo -e "Executing copy of $line2 to $DST DONE." echo -e "$DST$(basename $line2)" sudo /opt/splunk/bin/splunk rebuild "$DST$(basename $line2)" $INAME --ignore-read-error done<$FILE2 fi sudo rm -rf "./frozenmatched.txt" ########## echo " Do you want to restart splunk service? (y to continue or n to exit):" read ANSWER4; if [[ "$ANSWER4" == "y" ]]; then sudo /opt/splunk/bin/splunk restart fi ########## echo "################################" echo -e "## GOOD LUCk WITH BEST REGARDS##" echo "################################" #########

this is the github project if you need https://github.com/mehransafari/Splunk_FrozenData_FIND_by_DATE_and_Restore

it may help you

topic Script for finding frozen data by date range and restore them in Getting Data In

Script for finding frozen data by date range and restore them