https://community.splunk.com/t5/Getting-Data-In/use-delete-command-to-delete-data-can-I-restore-the-data/m-p/73120#M14949 <P>I had a test,I found the delete command didnot delete the .tsidx,It just move the hot data to a db_1342886374_1342282020_0,just like move to a warm db,but add a lot of other directories,such as deletes.So I think it maybe can restore?????However, I can reindex the data again use the raw data.</P> Mon, 28 Sep 2020 13:35:39 GMT itgrc 2020-09-28T13:35:39Z https://community.splunk.com/t5/Getting-Data-In/use-delete-command-to-delete-data-can-I-restore-the-data/m-p/73118#M14947 <P>use |delete command to delete data,I know the data just hide,not delete from the disk,can I restore the data?how to restore it?</P> Mon, 25 Mar 2013 07:22:30 GMT https://community.splunk.com/t5/Getting-Data-In/use-delete-command-to-delete-data-can-I-restore-the-data/m-p/73118#M14947 itgrc 2013-03-25T07:22:30Z https://community.splunk.com/t5/Getting-Data-In/use-delete-command-to-delete-data-can-I-restore-the-data/m-p/73119#M14948 <P>No you can not restore the data, I think, at least not easily. As I've understood it, the delete command will wipe those parts of the .tsidx file that refers to the data you want to delete (but not the data itself). </P> <P>However, if that is the case, perhaps there is some way of rebuilding the .tsidx from the .gz file?<BR /> Isn't that what's being done when thawing frozen buckets, i.e. <CODE>rebuild</CODE>?</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/5.0.2/Indexer/Restorearchiveddata">http://docs.splunk.com/Documentation/Splunk/5.0.2/Indexer/Restorearchiveddata</A></P> <P>Anyone got experience from this? Or have I misunderstood how the <CODE>delete</CODE> and <CODE>rebuild</CODE> commands work on the data?</P> <P>/K</P> Mon, 25 Mar 2013 08:49:39 GMT https://community.splunk.com/t5/Getting-Data-In/use-delete-command-to-delete-data-can-I-restore-the-data/m-p/73119#M14948 kristian_kolb 2013-03-25T08:49:39Z https://community.splunk.com/t5/Getting-Data-In/use-delete-command-to-delete-data-can-I-restore-the-data/m-p/73120#M14949 <P>I had a test,I found the delete command didnot delete the .tsidx,It just move the hot data to a db_1342886374_1342282020_0,just like move to a warm db,but add a lot of other directories,such as deletes.So I think it maybe can restore?????However, I can reindex the data again use the raw data.</P> Mon, 28 Sep 2020 13:35:39 GMT https://community.splunk.com/t5/Getting-Data-In/use-delete-command-to-delete-data-can-I-restore-the-data/m-p/73120#M14949 itgrc 2020-09-28T13:35:39Z