Deployment Architecture

Restoration of archived logs

Path Finder

Hi,

I have been able to restore the archived bucket successfully in Splunk by following the steps mentioned in the Splunk documentation for Windows.

But, the steps state that we have to restore every bucket individually, which will become very tedious in case there are a large number of buckets to be restored, say 100 or more.Is there any way of restoring all the buckets in one go?

Please help.

0 Karma
1 Solution

Splunk Employee
Splunk Employee

Write a script to iterate through the buckets to move them, then at the end of the script, restart Splunk. This is generally how most of us do it.

View solution in original post

Splunk Employee
Splunk Employee

Write a script to iterate through the buckets to move them, then at the end of the script, restart Splunk. This is generally how most of us do it.

View solution in original post

Path Finder

Thanks jtrucks, but I am relatively new to this field, it would be really helpful if you could share the script.

0 Karma

SplunkTrust
SplunkTrust

You may use any script (VBScript/Python) which may allow to your use loops to move all the archived bucket into thaweddb with proper name and then restart the splunk at once.

0 Karma