topic Re: Restore SCV in Splunk Enterprise Security

Restore SCV

pradeep577 — Mon, 24 Feb 2020 19:44:38 GMT

Hi,
I accidently deleted a CSV file. Is there any way to restore it or retrieve the CSV file.

Re: Restore SCV

efavreau — Mon, 24 Feb 2020 20:09:06 GMT

Not that I'm aware of. Sorry. It would be difficult to be fast enough to get to a system where the delete hadn't been replicated to yet. It's possible (depending on your environment), but that's not a real answer. All over Answers are several solutions to help with this in the future, because it is really unfortunate when it happens. I'll leave this as a comment, because maybe there's something I'm not thinking of. Good luck.

Re: Restore SCV

pradeep577 — Mon, 24 Feb 2020 21:18:05 GMT

Oh. thank you for quick response..

Re: Restore SCV

skalliger — Mon, 24 Feb 2020 22:20:31 GMT

Not an official way but.. have you pushed that lookup to the indexers maybe in a bundle? Then you might be able to find it under /opt/splunk/var/run/.