https://community.splunk.com/t5/Installation/How-can-I-restore-data-from-a-crashed-installation/m-p/65439#M9331 <P>If all the data is there and intact, you should be able to </P> <UL> <LI>Reinstall Splunk</LI> <LI>Restore the Splunk etc directory from a recent backup</LI> <LI>Start Splunk</LI> </UL> <P>In addition to making sure that your indexed info is all there, this will also restore your licenses, your users' saved searches, etc. etc.</P> <P>This is not the only way to get service restored, but it is the easiest way that I know. If you can't restore the Splunk etc directory, then you will need to reconstruct the configuration files; this would be a PITA. The data is described in indexes.conf - but that is only part of what you really need.</P> <P>It's great that your data partition survived intact.</P> <P>Post back if you need more help.</P> Fri, 01 Jun 2012 13:07:43 GMT lguinn2 2012-06-01T13:07:43Z https://community.splunk.com/t5/Installation/How-can-I-restore-data-from-a-crashed-installation/m-p/65438#M9330 <P>Our splunk server has 2 windows partitions, one for the OS and Splunk, the other for the splunk data.</P> <P>For reasons I shall not go into it has been necessary to trash the OS partition and rebuild it from scratch.</P> <P>I still have the splunk data on the data partition (and a tape backup). The server was shutdown cleanly prior to the OS partition being trashed.</P> <P>My plan is to reinstall the OS (currently underway) and then install Splunk. I will then need to import/restore the data some how but I am not sure how to go about this.</P> <P>Can anyone help?</P> Fri, 01 Jun 2012 10:21:06 GMT https://community.splunk.com/t5/Installation/How-can-I-restore-data-from-a-crashed-installation/m-p/65438#M9330 jezh 2012-06-01T10:21:06Z https://community.splunk.com/t5/Installation/How-can-I-restore-data-from-a-crashed-installation/m-p/65439#M9331 <P>If all the data is there and intact, you should be able to </P> <UL> <LI>Reinstall Splunk</LI> <LI>Restore the Splunk etc directory from a recent backup</LI> <LI>Start Splunk</LI> </UL> <P>In addition to making sure that your indexed info is all there, this will also restore your licenses, your users' saved searches, etc. etc.</P> <P>This is not the only way to get service restored, but it is the easiest way that I know. If you can't restore the Splunk etc directory, then you will need to reconstruct the configuration files; this would be a PITA. The data is described in indexes.conf - but that is only part of what you really need.</P> <P>It's great that your data partition survived intact.</P> <P>Post back if you need more help.</P> Fri, 01 Jun 2012 13:07:43 GMT https://community.splunk.com/t5/Installation/How-can-I-restore-data-from-a-crashed-installation/m-p/65439#M9331 lguinn2 2012-06-01T13:07:43Z