Restoration of archived logs

[garima_chauhan]

Hi,

I have been able to restore the archived bucket successfully in Splunk by following the steps mentioned in the Splunk documentation for Windows.

But, the steps state that we have to restore every bucket individually, which will become very tedious in case there are a large number of buckets to be restored, say 100 or more.Is there any way of restoring all the buckets in one go?

Please help.

[jtrucks · Accepted solution]

Write a script to iterate through the buckets to move them, then at the end of the script, restart Splunk. This is generally how most of us do it.

[garima_chauhan]

Thanks jtrucks, but I am relatively new to this field, it would be really helpful if you could share the script.

[somesoni2]

You may use any script (VBScript/Python) which may allow to your use loops to move all the archived bucket into thaweddb with proper name and then restart the splunk at once.