Could I restore data from dynamic data self storage (DDSS) to a Splunk Cloud instance?

[Remigiusz]

Could I restore data from dynamic data self storage (DDSS) to a Splunk Cloud instance? I know it isn't possible with splunk itself but could be achievable with lambda connected to splunk cloud HEC for example? Is there any other tool that could do this?

[enzomialich · Accepted solution]

Yes, you can make data searchable again but no in the cloud like using DDAA.

You can restore self storage data only to a Splunk Enterprise instance. You can't restore self storage data to a Splunk Cloud Platform instance.

To recover the information, transfer the exported data to the thawed path folder in a Splunk Enterprise instance, such as $SPLUNK_DB/defaultdb/thaweddb. After the data has been reinstated, you can proceed to query it.

When you restore data to the thawed directory on Splunk Enterprise, it does not count against the indexing license volume.

I would like to refer to the following docs to how restore indexed data, since it might depend on your storage system: https://docs.splunk.com/Documentation/SplunkCloud/9.0.2303/Admin/DataSelfStorage#Restore_indexed_dat...

[enzomialich]

Or if it's a Workload pricing I don't think you mind ingesting data again to a new index with a 30day retention period.

[richgalloway]

I believe this will not work.  If you send a bucket to Splunk, it may be interpreted as binary data and ignored.  If not, the timestamps on the data may be too old and the even dropped.  If the data is accepted then it probably will be frozen immediately since that how it ended up in DDSS in the first place.