Restore logs to Splunk

Deployment Architecture

Hi Team,

Please look into this case on priority :
In Splunk environment(3 Indexer,3 search head,1 deployment server) we have lost data for one application which is older than 3 months due to space issue and that was not archived anywhere.
When checked with backup team, they have the backup tapes which has entire backup data from all 3 indexers.

Please help or provide inputs on below points :
1. Would it be possible to restore the data again to Splunk
2. Is there any risk involved/any other way the purged data can make it searchable again in Splunk

Get Updates on the Splunk Community!

Restore logs to Splunk

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

A Four-Part Event Series: Full Stack Observability For the AI Era

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

Event Series: Level up your SOC: Advancing with Splunk Enterprise Security

Join the Conversation

Restore logs to Splunk

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

A Four-Part Event Series: Full Stack Observability For the AI Era

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

Event Series: Level up your SOC: Advancing with Splunk Enterprise Security