topic Re: Old data cannot load in Splunk Search

Old data cannot load

Eshmin — Fri, 07 Jan 2022 05:43:49 GMT

Splunk can not load old data only load current data. Though it shows event count. Before that I have moved some splunk cold db folder in several times to free up space . and it worked fine. I dont understand what happend now. Is there any way to recover data without splunk search? Installed in windows.

Re: Old data cannot load

Eshmin — Fri, 07 Jan 2022 06:51:15 GMT

Anyone there help me to recover data? I am willing to pay.

Re: Old data cannot load

SinghK — Fri, 07 Jan 2022 06:57:27 GMT

Did you manually move tsidx files??

Re: Old data cannot load

Eshmin — Fri, 07 Jan 2022 07:03:28 GMT

I have move folder from cold db. like the folders which was generated September month. and yes its contain tsidx file.

Re: Old data cannot load

SinghK — Fri, 07 Jan 2022 07:19:06 GMT

https://community.splunk.com/t5/Monitoring-Splunk/Restore-archived-data/m-p/76301

if this does not help open case with support.

Re: Old data cannot load

Eshmin — Fri, 07 Jan 2022 07:33:55 GMT

Sorry for my little knowledge about it. Is there any way to get expert help for data recovery Live chat or whatsApp number? Actually I have urgency to recover last month specific data.

without search is there any way to load file in CSV format? coz it shows event count 😞

Re: Old data cannot load

isoutamo — Fri, 07 Jan 2022 14:00:28 GMT

Disclaimer: I haven't try this with myself, so you no warranty are given and you are doing this with your own risk!

If I understood right you are moving some cold data, not frozen data? I suppose that you have only one instance as all-in-one setup (indexer, search head at the same node). If it's this way then basically you should restore the situation by

Stop splunk
Take backup of your DB_HOME
Add need space for that old data under DB_HOME
Move/copy old data to it's original place
Start splunk

Another option could be that you manage it as thawed data and restore it to thaweddb directory for that index. Basically there shouldn't be need to rebuild that dir as you have moved those files without removing metadata from it. Anyhow You should stop your splunk instance and do actions when it's down.

When you are starting it look what kind of errors you will gotten to splunkd.log. Especially if it cannot start.

r. Ismo