https://community.splunk.com/t5/Knowledge-Management/How-to-restore-archived-logs/m-p/181052#M7705 <P>Hi all ,</P> <P>I have configured Splunk buckets to archive indexed logs after 1 month. I will store the archived logs in the offsite location for 7 years. However I am not sure about 2 points about restoration steps of archived logs.</P> <OL> <LI>If I have to restore archive buckets of only 1 month then how to identify buckets of this time frame.</LI> <LI>Splunk restoration steps says about restoration of archive buckets one by one. How can I restore all the buckets in one go. If anyone has developed any script, I am requesting him/her to please share the same as I am virtually handicap in coding.</LI> </OL> <P>Regards<BR /> Lohit</P> Tue, 17 Dec 2013 11:35:29 GMT lohit 2013-12-17T11:35:29Z https://community.splunk.com/t5/Knowledge-Management/How-to-restore-archived-logs/m-p/181052#M7705 <P>Hi all ,</P> <P>I have configured Splunk buckets to archive indexed logs after 1 month. I will store the archived logs in the offsite location for 7 years. However I am not sure about 2 points about restoration steps of archived logs.</P> <OL> <LI>If I have to restore archive buckets of only 1 month then how to identify buckets of this time frame.</LI> <LI>Splunk restoration steps says about restoration of archive buckets one by one. How can I restore all the buckets in one go. If anyone has developed any script, I am requesting him/her to please share the same as I am virtually handicap in coding.</LI> </OL> <P>Regards<BR /> Lohit</P> Tue, 17 Dec 2013 11:35:29 GMT https://community.splunk.com/t5/Knowledge-Management/How-to-restore-archived-logs/m-p/181052#M7705 lohit 2013-12-17T11:35:29Z https://community.splunk.com/t5/Knowledge-Management/How-to-restore-archived-logs/m-p/181053#M7706 <P>The bucket names Splunk assigns have two timestamps, giving the time range of events in the bucket. You'll need all the buckets that cover the time range you are interested in.</P> <P>For restoring multiple buckets you might want to have a look at <A href="https://github.com/splunk/splunk-shuttl">shuttl</A>.</P> Tue, 17 Dec 2013 21:23:20 GMT https://community.splunk.com/t5/Knowledge-Management/How-to-restore-archived-logs/m-p/181053#M7706 dart 2013-12-17T21:23:20Z https://community.splunk.com/t5/Knowledge-Management/How-to-restore-archived-logs/m-p/181054#M7707 <P>Try this python script </P> <BLOCKQUOTE> <P><A href="https://github.com/tuwid/splunk_frozen_db_restore">https://github.com/tuwid/splunk_frozen_db_restore</A></P> </BLOCKQUOTE> <PRE><CODE>root@XXXXXX:~# python splunk_frozen_db_restore.py We're using the default index path, for custom indexes please adjust the path variable here Enter index:winevents_security Enter start date: (eg 30.12.2015): 31.12.2015 Enter end date: (eg 30.12.2015): 01.01.2016 [+] Searching dates on index winevents_security in /opt/splunk/var/lib/splunk/winevents_security/frozendb/ 1451516400 1451602800 Got 313 elements from /opt/splunk/var/lib/splunk/winevents_security/frozendb/ Found : db_1452350660_1451453107_329 [+] Copying databases into thaweddb.. cp -R /opt/splunk/var/lib/splunk/winevents_security/frozendb/db_1452350660_1451453107_329 /opt/splunk/var/lib/splunk/winevents_security/thaweddb/ [+] Rebuilding DBs splunkd fsck repair --one-bucket --include-hots --bucket-path=/opt/splunk/var/lib/splunk/winevents_security/thaweddb/db_1452350660_1451453107_329 --log-to--splunkd-log </CODE></PRE> Thu, 21 Apr 2016 14:00:37 GMT https://community.splunk.com/t5/Knowledge-Management/How-to-restore-archived-logs/m-p/181054#M7707 arber 2016-04-21T14:00:37Z