https://community.splunk.com/t5/Getting-Data-In/Steps-to-restor-Frozen-Data/m-p/534768#M89720 <P>Thanks a lot</P> Tue, 05 Jan 2021 09:52:15 GMT saeed 2021-01-05T09:52:15Z https://community.splunk.com/t5/Getting-Data-In/Steps-to-restor-Frozen-Data/m-p/534631#M89706 <P>Hi, (My<SPAN> Splunk Apps are installed on Linux Servers)</SPAN></P><P>I would like to restore logs from frozen data and read them</P><P>So please I need the steps to do it.</P> Sun, 03 Jan 2021 11:14:37 GMT https://community.splunk.com/t5/Getting-Data-In/Steps-to-restor-Frozen-Data/m-p/534631#M89706 saeed 2021-01-03T11:14:37Z https://community.splunk.com/t5/Getting-Data-In/Steps-to-restor-Frozen-Data/m-p/534632#M89707 <P>Copy the directory from frozen directory to thaweddb. Then run the below command</P><P>splunk rebuild [path to thawed bucket]&nbsp;</P><P>e.g. splunk rebuilt \opt\splunk\var\lib\splunk\defaultdb\thaweddb\db_1181756465_1162600547_1001</P><P>Restart the indexer</P><P><A href="https://docs.splunk.com/Documentation/Splunk/8.1.1/Indexer/Restorearchiveddata#.2Anix_users" target="_blank">https://docs.splunk.com/Documentation/Splunk/8.1.1/Indexer/Restorearchiveddata#.2Anix_users</A></P> Sun, 03 Jan 2021 11:51:46 GMT https://community.splunk.com/t5/Getting-Data-In/Steps-to-restor-Frozen-Data/m-p/534632#M89707 saravanan90 2021-01-03T11:51:46Z https://community.splunk.com/t5/Getting-Data-In/Steps-to-restor-Frozen-Data/m-p/534768#M89720 <P>Thanks a lot</P> Tue, 05 Jan 2021 09:52:15 GMT https://community.splunk.com/t5/Getting-Data-In/Steps-to-restor-Frozen-Data/m-p/534768#M89720 saeed 2021-01-05T09:52:15Z