topic How to restore deleted data in dashboard in Dashboards & Visualizations

How to restore deleted data in dashboard

kdanielsobrien — Mon, 18 Nov 2019 20:09:22 GMT

I have just set up a dashboard with some data from .csv files.

It was working until I made the local host available via link and it seems like all my data got deleted.

I can still see the CSV files in the Dataset and their corresponding lookups.
When I index the data, it says no results found.

Is there any way to get the data back without adding it again?
I am using the free version so I don't want to use all of my 500 MB.

Re: How to restore deleted data in dashboard

mayurr98 — Mon, 18 Nov 2019 21:53:25 GMT

Run this index=* in search bar and select All time in time range picker.

Re: How to restore deleted data in dashboard

kdanielsobrien — Fri, 22 Nov 2019 18:21:27 GMT

I've tried that and it still says no results... I re-added the data again and everything was working fine.... A few days later it happened again

Re: How to restore deleted data in dashboard

mayurr98 — Fri, 22 Nov 2019 18:28:13 GMT

well, that maybe because of the retention period. did you check what is the retention period for that index?

Re: How to restore deleted data in dashboard

woodcock — Fri, 22 Nov 2019 18:28:35 GMT

If it no longer shows with an All time search then somebody deleted it. If splunk did, then you should find evidence of it with this search:

index=_* bucketmover

Re: How to restore deleted data in dashboard

kdanielsobrien — Fri, 22 Nov 2019 18:33:30 GMT

I didn't change/modify the retention period. Where would I find that information?

Re: How to restore deleted data in dashboard

kdanielsobrien — Fri, 22 Nov 2019 18:33:53 GMT

What kind of information would I be looking for in the results?

Re: How to restore deleted data in dashboard

kdanielsobrien — Fri, 22 Nov 2019 18:37:28 GMT

I should also mention the data is from 9 years ago.. Is the index retention period from the timestamp on the data or when it is uploaded to splunk?

Re: How to restore deleted data in dashboard

woodcock — Fri, 22 Nov 2019 19:18:39 GMT

The bucketmover process moves the buckets from hot -> warm (no problem there) and from warm -> cold (which in your case probably means deleted).