Log restoration process

Rbsplunk95 — Fri, 27 Nov 2020 11:36:47 GMT

Hello everyone, I am facing some issues with log restoration process from azure cloud to splunk . I have gone through the epoch time conversion process to get the exact date for file. then restore the particular file using the shell commands.

But right now I want to restore two months of log data in splunk. so the previous process is really time taking and there is a chance that we might miss some of the data for a particular time interval.

So is there any way we can restore the two months of date using some prebuild commands or is there any process to ease the task.

Thanks in advance.

Re: Log restoration process

lkutch_splunk — Tue, 01 Dec 2020 20:09:28 GMT

Hi,

I'm not sure if this is what you're asking about, but there's a doc on restoring based on internal audit logs:

https://docs.splunk.com/Documentation/ES/6.4.0/Install/InstallEnterpriseSecuritySHC#Restore_incident_review_history_from_internal_audit_logs

topic Re: Log restoration process in Splunk Enterprise Security

Log restoration process

Re: Log restoration process