Is there a way to not lose all the events in this bucket with a corrupted journal.zst file?

[aatik5u]

Hello everyone!

I am working on test environment where I only have one Splunk instance. I edited on the journal.zst file in one of my buckets (I have a buckup) just to test the data integrity, so now it's corrupted. my question is, is there a way to not lose all the events in this bucket ? I tried fsck and rebuild but the bucket is still corrupted with data integrity check being unsuccessful which is normal.

I'm not sure if it's possible in the real world to face such an issue, but m curious to know what would the best strategy be.

any help would be appreciated 🙂 

[richgalloway]

Have you tried restoring the backup?

[aatik5u]

thank you @richgalloway  for your answer.

yes when I use the backup it is not corrupted. I guess my question didn't make any sense.