https://community.splunk.com/t5/Getting-Data-In/How-to-restore-to-5-x-from-6-0/m-p/135230#M97832 <P>First you will want to roll everything from Hot to warm. Then delete the hot buckets. When you restart Splunk after the rollback, it will create new hot buckets.</P> <P>This is the command for it, just replace the index name with the name of your index(es) and your username/pw.</P> <P>splunk _internal call /data/indexes/<INDEX_NAME>/roll-hot-buckets –auth <ADMIN_USERNAME>:<ADMIN_PASSWORD></ADMIN_PASSWORD></ADMIN_USERNAME></INDEX_NAME></P> Mon, 28 Sep 2020 15:15:30 GMT ShaneNewman 2020-09-28T15:15:30Z https://community.splunk.com/t5/Getting-Data-In/How-to-restore-to-5-x-from-6-0/m-p/135227#M97829 <P>I copied the /opt/splunk directory before upgrading to 6.0. Now I find that none of the forwarders work. They are not forwarding the transactions to 6.0. We don't have the time to send the 6.0 forwarder to the laptops to see if they will work, so we need to restore. What is the procedure? Just delete the /opt/splunk 6.0 structure and copy back the old 5.x structure to /opt/splunk?</P> Fri, 08 Nov 2013 20:07:16 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-restore-to-5-x-from-6-0/m-p/135227#M97829 RVDowning 2013-11-08T20:07:16Z https://community.splunk.com/t5/Getting-Data-In/How-to-restore-to-5-x-from-6-0/m-p/135228#M97830 <P>That is what I did. I did have to delete a few of the index files to keep get the indexes to come back up afterwards.</P> Sat, 09 Nov 2013 03:03:23 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-restore-to-5-x-from-6-0/m-p/135228#M97830 ShaneNewman 2013-11-09T03:03:23Z https://community.splunk.com/t5/Getting-Data-In/How-to-restore-to-5-x-from-6-0/m-p/135229#M97831 <P>From which bucket did you wipe out files? The hot bucket? How did you recreate those indexes?</P> Tue, 12 Nov 2013 13:01:56 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-restore-to-5-x-from-6-0/m-p/135229#M97831 RVDowning 2013-11-12T13:01:56Z https://community.splunk.com/t5/Getting-Data-In/How-to-restore-to-5-x-from-6-0/m-p/135230#M97832 <P>First you will want to roll everything from Hot to warm. Then delete the hot buckets. When you restart Splunk after the rollback, it will create new hot buckets.</P> <P>This is the command for it, just replace the index name with the name of your index(es) and your username/pw.</P> <P>splunk _internal call /data/indexes/<INDEX_NAME>/roll-hot-buckets –auth <ADMIN_USERNAME>:<ADMIN_PASSWORD></ADMIN_PASSWORD></ADMIN_USERNAME></INDEX_NAME></P> Mon, 28 Sep 2020 15:15:30 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-restore-to-5-x-from-6-0/m-p/135230#M97832 ShaneNewman 2020-09-28T15:15:30Z https://community.splunk.com/t5/Getting-Data-In/How-to-restore-to-5-x-from-6-0/m-p/135231#M97833 <P>Link to the documentation:<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/6.0/Indexer/Backupindexeddata">http://docs.splunk.com/Documentation/Splunk/6.0/Indexer/Backupindexeddata</A></P> Tue, 12 Nov 2013 15:12:04 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-restore-to-5-x-from-6-0/m-p/135231#M97833 ShaneNewman 2013-11-12T15:12:04Z