topic Can we restore data from one single host? in Monitoring Splunk

Can we restore data from one single host?

arunkuriakose — Fri, 07 Jul 2023 17:00:41 GMT

Is it possible to restore archive data from one single host

consider we have an index=windows ,we want to restore archive data only for one host

ie;index=windows host=xxx . Is it possible someway?

Thanks in advance

Re: Can we restore data from one single host

isoutamo — Thu, 06 Jul 2023 07:38:41 GMT

I suppose that you are talking about restore frozen data to thawed? Unfortunately you must restore whole buckets at a time. There is no way (or at least any supported/easy) to first select data based on host and then thawed it.

r. Ismo

Re: Can we restore data from one single host

PickleRick — Thu, 06 Jul 2023 08:01:47 GMT

Restore from where?

Generally, data is kept in buckets and buckets keep some part of events for a given index. There's no differentiation on host, source, sourcetype or other fields level. The only thing that can make events fall into one bucket or another is time (because of quarantine buckets which gather all "out of time" events).

So if you want to thaw a frozen bucket, you can only thaw a whole bucket. You can't choose some part of it.