Restore logs to Splunk

Deployment Architecture

Hi Team,

Please look into this case on priority :
In Splunk environment(3 Indexer,3 search head,1 deployment server) we have lost data for one application which is older than 3 months due to space issue and that was not archived anywhere.
When checked with backup team, they have the backup tapes which has entire backup data from all 3 indexers.

Please help or provide inputs on below points :
1. Would it be possible to restore the data again to Splunk
2. Is there any risk involved/any other way the purged data can make it searchable again in Splunk

Get Updates on the Splunk Community!

Restore logs to Splunk

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Automating Threat Operations and Threat Hunting with Recorded Future

Join the Conversation

Restore logs to Splunk

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Automating Threat Operations and Threat Hunting with Recorded Future