https://community.splunk.com/t5/Getting-Data-In/how-to-restore-data-from-a-frozen-archived-bucket/m-p/398217#M70992 <P>i have the frozen data archived in this path" /nfs-storage/frozen_path/cisco_asa/ " and when tried to restore it in splunk again i copied the bucket from this path to the thawed path using this command:</P> <P>[root@eib-siem cisco_asa]# cp -r db_1530576360_1530222901_40 /nfs-storage/thawed_path/cisco_asa/</P> <P>and when tried to run the rebuild command give me the following output: <BR /> [root@eib-siem cisco_asa]# splunk rebuild /nfs-storage/thawed_path/cisco_asa/db_1530576360_1530222901_40<BR /> -bash: splunk: command not found</P> <P>so i tried to run it as follow:<BR /> [root@eib-siem ~]# cd /opt/splunk/bin/<BR /> [root@eib-siem bin]# ./splunk rebuild /nfs-storage/thawed_path/cisco_asa/db_1530576360_1530222901_40<BR /> USAGE: splunk rebuild [] [--ignore-read-error] [--no-log]<BR /> Please see 'splunk fsck' for more options. This command is just a wrapper for 'splunk fsck'.</P> <P>Redirecting to 'splunkd fsck' with args:<BR /> repair --one-bucket --include-hots --bucket-path=/nfs-storage/thawed_path/cisco_asa/db_1530576360_1530222901_40 --log-to--splunkd-log<BR /> ERROR ProcessTracker - (subchild_43__RollFixMetadata) IndexConfig - Asked to check if idx= is an index with a remote storage, but that index does not exist on the system or is disabled<BR /> INFO Fsck - (entire bucket) Rebuild for bucket='/nfs-storage/thawed_path/cisco_asa/db_1530576360_1530222901_40' took 149.3 seconds</P> <P>can anyone help me to solve this error????!!!!....</P> Tue, 29 Sep 2020 21:25:24 GMT ahmedzard 2020-09-29T21:25:24Z https://community.splunk.com/t5/Getting-Data-In/how-to-restore-data-from-a-frozen-archived-bucket/m-p/398217#M70992 <P>i have the frozen data archived in this path" /nfs-storage/frozen_path/cisco_asa/ " and when tried to restore it in splunk again i copied the bucket from this path to the thawed path using this command:</P> <P>[root@eib-siem cisco_asa]# cp -r db_1530576360_1530222901_40 /nfs-storage/thawed_path/cisco_asa/</P> <P>and when tried to run the rebuild command give me the following output: <BR /> [root@eib-siem cisco_asa]# splunk rebuild /nfs-storage/thawed_path/cisco_asa/db_1530576360_1530222901_40<BR /> -bash: splunk: command not found</P> <P>so i tried to run it as follow:<BR /> [root@eib-siem ~]# cd /opt/splunk/bin/<BR /> [root@eib-siem bin]# ./splunk rebuild /nfs-storage/thawed_path/cisco_asa/db_1530576360_1530222901_40<BR /> USAGE: splunk rebuild [] [--ignore-read-error] [--no-log]<BR /> Please see 'splunk fsck' for more options. This command is just a wrapper for 'splunk fsck'.</P> <P>Redirecting to 'splunkd fsck' with args:<BR /> repair --one-bucket --include-hots --bucket-path=/nfs-storage/thawed_path/cisco_asa/db_1530576360_1530222901_40 --log-to--splunkd-log<BR /> ERROR ProcessTracker - (subchild_43__RollFixMetadata) IndexConfig - Asked to check if idx= is an index with a remote storage, but that index does not exist on the system or is disabled<BR /> INFO Fsck - (entire bucket) Rebuild for bucket='/nfs-storage/thawed_path/cisco_asa/db_1530576360_1530222901_40' took 149.3 seconds</P> <P>can anyone help me to solve this error????!!!!....</P> Tue, 29 Sep 2020 21:25:24 GMT https://community.splunk.com/t5/Getting-Data-In/how-to-restore-data-from-a-frozen-archived-bucket/m-p/398217#M70992 ahmedzard 2020-09-29T21:25:24Z https://community.splunk.com/t5/Getting-Data-In/how-to-restore-data-from-a-frozen-archived-bucket/m-p/398218#M70993 <P>Try these instruction mentioned in this post-<BR /> <A href="https://answers.splunk.com/answers/80882/corrupted-bucket-journal.html">https://answers.splunk.com/answers/80882/corrupted-bucket-journal.html</A></P> Wed, 03 Oct 2018 11:59:25 GMT https://community.splunk.com/t5/Getting-Data-In/how-to-restore-data-from-a-frozen-archived-bucket/m-p/398218#M70993 493669 2018-10-03T11:59:25Z https://community.splunk.com/t5/Getting-Data-In/how-to-restore-data-from-a-frozen-archived-bucket/m-p/398219#M70994 <P><A href="https://docs.splunk.com/Documentation/Splunk/7.1.3/Indexer/Restorearchiveddata">https://docs.splunk.com/Documentation/Splunk/7.1.3/Indexer/Restorearchiveddata</A></P> Wed, 03 Oct 2018 13:53:48 GMT https://community.splunk.com/t5/Getting-Data-In/how-to-restore-data-from-a-frozen-archived-bucket/m-p/398219#M70994 kmorris_splunk 2018-10-03T13:53:48Z https://community.splunk.com/t5/Getting-Data-In/how-to-restore-data-from-a-frozen-archived-bucket/m-p/398220#M70995 <P>I followed this document before posting this question and faced the above error, thanks for your help</P> Sun, 07 Oct 2018 07:50:25 GMT https://community.splunk.com/t5/Getting-Data-In/how-to-restore-data-from-a-frozen-archived-bucket/m-p/398220#M70995 ahmedzard 2018-10-07T07:50:25Z