Dashboards & Visualizations

How to restore deleted data in dashboard

kdanielsobrien
Explorer

I have just set up a dashboard with some data from .csv files.

It was working until I made the local host available via link and it seems like all my data got deleted.

I can still see the CSV files in the Dataset and their corresponding lookups.
When I index the data, it says no results found.

Is there any way to get the data back without adding it again?
I am using the free version so I don't want to use all of my 500 MB.

0 Karma

woodcock
Esteemed Legend

If it no longer shows with an All time search then somebody deleted it. If splunk did, then you should find evidence of it with this search:

index=_* bucketmover
0 Karma

kdanielsobrien
Explorer

What kind of information would I be looking for in the results?

0 Karma

woodcock
Esteemed Legend

The bucketmover process moves the buckets from hot -> warm (no problem there) and from warm -> cold (which in your case probably means deleted).

0 Karma

mayurr98
Super Champion

Run this index=* in search bar and select All time in time range picker.

0 Karma

kdanielsobrien
Explorer

I've tried that and it still says no results... I re-added the data again and everything was working fine.... A few days later it happened again

0 Karma

mayurr98
Super Champion

well, that maybe because of the retention period. did you check what is the retention period for that index?

0 Karma

kdanielsobrien
Explorer

I didn't change/modify the retention period. Where would I find that information?

0 Karma

kdanielsobrien
Explorer

I should also mention the data is from 9 years ago.. Is the index retention period from the timestamp on the data or when it is uploaded to splunk?

0 Karma
Get Updates on the Splunk Community!

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more with ITSI’s ...

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more! Faster Time to ValueManaging and ...

New Release | Splunk Enterprise 9.3

Hi Splunky people! We are excited to share the newest updates in Splunk Enterprise 9.3!Admins and Analyst can ...

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...