topic Re: What is the best practice for restoring from archive? in Getting Data In

What is the best practice for restoring from archive?

the_wolverine — Tue, 18 May 2010 03:54:25 GMT

I have data that was archived that I want to access. How do I go about restoring my archived data so that it is searchable again?

the_wolverine — Tue, 18 May 2010 04:12:10 GMT

Assuming you are doing this in version 4.1, let's say you have the following archived bucket:

db_1274129994_1273525194_0

Move the bucket to the designated index's thaweddb. For example, if you are restoring to the main index, move it to: $SPLUNK_HOME/var/lib/splunk/defaultdb/thaweddb

Example:

# cp -r db_1274129994_1273525194_0 $SPLUNK_HOME/var/lib/splunk/defaultdb/thaweddb/temporary-db_1274129994_1273525194_0

Note that, while unlikely, make sure that there isn't a bucket naming conflict. In other words, there should be no existing bucket with the same name in that directory. If so, rename the bucket by changing the bucket id (in the example above, the bucket id is 0.)
1. Run the following command from CLI and specify the admin username:password to force Splunk to recognize the restored data.

Example:

 # $SPLUNK_HOME/bin/splunk _internal call /data/indexes/main/rebuild-metadata-and-manifests -auth admin:changeme

piebob — Tue, 18 May 2010 04:14:44 GMT

You can restore archived data by moving the archive into the thawed directory, $SPLUNK_HOME/var/lib/splunk/defaultdb/thaweddb.

further details here:

MuS — Thu, 26 Apr 2012 13:33:29 GMT

how whould that work on 4.3.x... still this way or did it change and you have to put the bucket somewhere else?

the_wolverine — Tue, 01 May 2012 18:29:32 GMT

There's still a thaweddb in 4.3 so I will assume that this works the same way.