https://community.splunk.com/t5/Getting-Data-In/Restoring-specific-source-from-frozen/m-p/391293#M69952 <P>Hey,<BR /> when thawing (restoring) frozen data, you're limited to the name of the index, and the time range of the bucket(s) of that index you want to restore.<BR /> You can find details on how to do this in the <A href="https://docs.splunk.com/Documentation/Splunk/7.1.0/Indexer/Restorearchiveddata">"Restore archived indexed data" doc</A>.</P> <P>Hope that helps - if it does I'd be happy if you would upvote/accept this answer, so others could profit from it. <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Tue, 15 May 2018 13:22:13 GMT xpac 2018-05-15T13:22:13Z https://community.splunk.com/t5/Getting-Data-In/Restoring-specific-source-from-frozen/m-p/391292#M69951 <P>Hello guys,</P> <P>we need to restore frozen data, however is it possible to choose which source to restore (not all sources), if yes, how?</P> <P>Thanks.</P> Tue, 15 May 2018 13:07:49 GMT https://community.splunk.com/t5/Getting-Data-In/Restoring-specific-source-from-frozen/m-p/391292#M69951 splunkreal 2018-05-15T13:07:49Z https://community.splunk.com/t5/Getting-Data-In/Restoring-specific-source-from-frozen/m-p/391293#M69952 <P>Hey,<BR /> when thawing (restoring) frozen data, you're limited to the name of the index, and the time range of the bucket(s) of that index you want to restore.<BR /> You can find details on how to do this in the <A href="https://docs.splunk.com/Documentation/Splunk/7.1.0/Indexer/Restorearchiveddata">"Restore archived indexed data" doc</A>.</P> <P>Hope that helps - if it does I'd be happy if you would upvote/accept this answer, so others could profit from it. <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Tue, 15 May 2018 13:22:13 GMT https://community.splunk.com/t5/Getting-Data-In/Restoring-specific-source-from-frozen/m-p/391293#M69952 xpac 2018-05-15T13:22:13Z