Archive

Restore indexed data

New Member

We had an app installed on our Splunk console that created its own index. We've removed the application but wanted to save the data. The indexed data is still around in a 'colddb' but we cannot figure out how to get search to see this data again now that the app has been removed.

Tags (2)
0 Karma
1 Solution

Splunk Employee
Splunk Employee

easy method : download the app again and check inside for the indexes.conf
then copy the content in your own indexes.conf in another app or in .../etc/system/local, the restart.

other method :
let's say your old index was named kowabunga and came with 3 folders, the indexes.conf should have been like

[kowabunga]
homePath=$SPLUNK_DB/kowabunga/db
coldPath=$SPLUNK_DB/kowabunga/colddb
thawedPath=$SPLUNK_DB/kowabunga/thaweddb

  • create the same index named kowabunga or another name. Using the manager > indexes, or by editing the indexes.conf configuration in an app or in .../etc/system/local, pick the folder location.
  • restart to apply if you used the configuration
  • if you changed the location/name, simply move the the data from your old homePath (kowabunga/db/) and coldPath (kowabunga/colddb) to the same folders in the new index.
  • then restart and search with index=kowabunga
  • you can also check the role permissions to search this new index

View solution in original post

Splunk Employee
Splunk Employee

easy method : download the app again and check inside for the indexes.conf
then copy the content in your own indexes.conf in another app or in .../etc/system/local, the restart.

other method :
let's say your old index was named kowabunga and came with 3 folders, the indexes.conf should have been like

[kowabunga]
homePath=$SPLUNK_DB/kowabunga/db
coldPath=$SPLUNK_DB/kowabunga/colddb
thawedPath=$SPLUNK_DB/kowabunga/thaweddb

  • create the same index named kowabunga or another name. Using the manager > indexes, or by editing the indexes.conf configuration in an app or in .../etc/system/local, pick the folder location.
  • restart to apply if you used the configuration
  • if you changed the location/name, simply move the the data from your old homePath (kowabunga/db/) and coldPath (kowabunga/colddb) to the same folders in the new index.
  • then restart and search with index=kowabunga
  • you can also check the role permissions to search this new index

View solution in original post

New Member

That worked! Thanks!

0 Karma