Archive
Highlighted

Data restore from frozen bucket

Communicator

Hi is anyone help me how can i restore data from a frozen bucket to make it searchable in an indexer clustering environment ?

Tags (1)
0 Karma
Highlighted

Re: Data restore from frozen bucket

SplunkTrust
SplunkTrust
0 Karma
Highlighted

Re: Data restore from frozen bucket

Communicator

Hi soni i have gone through this document i have an indexer cluster so in any indexer i can login and go to that index and copy the files to the thawdb directory ? Or should i do it in indexer cluater master ?

0 Karma
Highlighted

Re: Data restore from frozen bucket

SplunkTrust
SplunkTrust

You can thaw the data, by placing the data into the thawed directories of the peer nodes from which it was originally archived. So frozen buckets of indexer1 would be placed in thawdb directory of indexer1 itself. Do this for all the indexers.

0 Karma
Highlighted

Re: Data restore from frozen bucket

Communicator

how can i know that this data is archived from which indexer, also whats the location for frozen bucket i am assuming it /var/lib/splunk/(indexer_name)/thaweddb right ? , also after moving the data i need to rebuild it and execute the restart of all indexers ?

0 Karma
Highlighted

Re: Data restore from frozen bucket

SplunkTrust
SplunkTrust

look for the GUID that attached to the bucket name and match it to the GUID of the indexer

0 Karma