Getting Data In

Could I restore data from dynamic data self storage (DDSS) to a Splunk Cloud instance?

Remigiusz
Explorer

Could I restore data from dynamic data self storage (DDSS) to a Splunk Cloud instance? I know it isn't possible with splunk itself but could be achievable with lambda connected to splunk cloud HEC for example? Is there any other tool that could do this?

Labels (2)
0 Karma
1 Solution

enzomialich
Path Finder

Yes, you can make data searchable again but no in the cloud like using DDAA.

You can restore self storage data only to a Splunk Enterprise instance. You can't restore self storage data to a Splunk Cloud Platform instance.

To recover the information, transfer the exported data to the thawed path folder in a Splunk Enterprise instance, such as $SPLUNK_DB/defaultdb/thaweddb. After the data has been reinstated, you can proceed to query it.

When you restore data to the thawed directory on Splunk Enterprise, it does not count against the indexing license volume.

 

I would like to refer to the following docs to how restore indexed data, since it might depend on your storage system: https://docs.splunk.com/Documentation/SplunkCloud/9.0.2303/Admin/DataSelfStorage#Restore_indexed_dat...

View solution in original post

enzomialich
Path Finder

Yes, you can make data searchable again but no in the cloud like using DDAA.

You can restore self storage data only to a Splunk Enterprise instance. You can't restore self storage data to a Splunk Cloud Platform instance.

To recover the information, transfer the exported data to the thawed path folder in a Splunk Enterprise instance, such as $SPLUNK_DB/defaultdb/thaweddb. After the data has been reinstated, you can proceed to query it.

When you restore data to the thawed directory on Splunk Enterprise, it does not count against the indexing license volume.

 

I would like to refer to the following docs to how restore indexed data, since it might depend on your storage system: https://docs.splunk.com/Documentation/SplunkCloud/9.0.2303/Admin/DataSelfStorage#Restore_indexed_dat...

enzomialich
Path Finder

Or if it's a Workload pricing I don't think you mind ingesting data again to a new index with a 30day retention period.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I believe this will not work.  If you send a bucket to Splunk, it may be interpreted as binary data and ignored.  If not, the timestamps on the data may be too old and the even dropped.  If the data is accepted then it probably will be frozen immediately since that how it ended up in DDSS in the first place.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...