Solved: Re: Re-indexing cold data

loatswil · ‎04-23-2014

We have some year old cold data that has been restored from tape. We would like to re-index and search this data.

What is the best way to do this?

I have looked at the "oneshot" method but it appears to be designed for a single log file. This is an entire "colddb" directory from an indexer.

Thanks!

yannK · ‎04-23-2014

You do not need to reindex buckets, just make them searchable.
Use the same procedure than restoring frozen buckets : copy them to your thawedPath location.
see http://docs.splunk.com/Documentation/Splunk/6.0.3/Indexer/Restorearchiveddata

Remark : you could copy them back to the coldPath, but the retention rules (size and time) will immediately apply, and the buckets can be deleted. So the thawedPath is the best solution.

View solution in original post

yannK · ‎04-23-2014

You do not need to reindex buckets, just make them searchable.
Use the same procedure than restoring frozen buckets : copy them to your thawedPath location.
see http://docs.splunk.com/Documentation/Splunk/6.0.3/Indexer/Restorearchiveddata

Remark : you could copy them back to the coldPath, but the retention rules (size and time) will immediately apply, and the buckets can be deleted. So the thawedPath is the best solution.

Re-indexing cold data

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Thanks for the Memories: .conf26 Took Learning to New Heights

Best Practices: Splunk auto adjust pipeline queue

Splunk Auto Ingestion Parallel Pipeline Scaling

Join the Conversation