topic Re: Could I restore data from dynamic data self storage (DDSS) to a Splunk Cloud instance? in Getting Data In

Could I restore data from dynamic data self storage (DDSS) to a Splunk Cloud instance?

Remigiusz — Wed, 09 Nov 2022 15:09:28 GMT

Could I restore data from dynamic data self storage (DDSS) to a Splunk Cloud instance? I know it isn't possible with splunk itself but could be achievable with lambda connected to splunk cloud HEC for example? Is there any other tool that could do this?

Re: Could I restore data from dynamic data self storage (DDSS) to a Splunk Cloud instance?

richgalloway — Wed, 09 Nov 2022 17:01:33 GMT

I believe this will not work. If you send a bucket to Splunk, it may be interpreted as binary data and ignored. If not, the timestamps on the data may be too old and the even dropped. If the data is accepted then it probably will be frozen immediately since that how it ended up in DDSS in the first place.

Re: Could I restore data from dynamic data self storage (DDSS) to a Splunk Cloud instance?

enzomialich — Sat, 29 Apr 2023 11:02:16 GMT

Yes, you can make data searchable again but no in the cloud like using DDAA.

You can restore self storage data only to a Splunk Enterprise instance. You can't restore self storage data to a Splunk Cloud Platform instance.

To recover the information, transfer the exported data to the thawed path folder in a Splunk Enterprise instance, such as $SPLUNK_DB/defaultdb/thaweddb. After the data has been reinstated, you can proceed to query it.

When you restore data to the thawed directory on Splunk Enterprise, it does not count against the indexing license volume.

I would like to refer to the following docs to how restore indexed data, since it might depend on your storage system: https://docs.splunk.com/Documentation/SplunkCloud/9.0.2303/Admin/DataSelfStorage#Restore_indexed_data_from_an_AWS_S3_bucket

Re: Could I restore data from dynamic data self storage (DDSS) to a Splunk Cloud instance?

enzomialich — Sat, 29 Apr 2023 11:03:28 GMT

Or if it's a Workload pricing I don't think you mind ingesting data again to a new index with a 30day retention period.