Deployment Architecture

Restoration of archived logs

garima_chauhan
Path Finder

Hi,

I have been able to restore the archived bucket successfully in Splunk by following the steps mentioned in the Splunk documentation for Windows.

But, the steps state that we have to restore every bucket individually, which will become very tedious in case there are a large number of buckets to be restored, say 100 or more.Is there any way of restoring all the buckets in one go?

Please help.

0 Karma
1 Solution

jtrucks
Splunk Employee
Splunk Employee

Write a script to iterate through the buckets to move them, then at the end of the script, restart Splunk. This is generally how most of us do it.

View solution in original post

jtrucks
Splunk Employee
Splunk Employee

Write a script to iterate through the buckets to move them, then at the end of the script, restart Splunk. This is generally how most of us do it.

garima_chauhan
Path Finder

Thanks jtrucks, but I am relatively new to this field, it would be really helpful if you could share the script.

0 Karma

somesoni2
Revered Legend

You may use any script (VBScript/Python) which may allow to your use loops to move all the archived bucket into thaweddb with proper name and then restart the splunk at once.

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>