Getting Data In

How to restore frozen archived data, multiple buckets, months of data?

Communicator

I was recently asked to restore a couple months of data.

After reading>>> https://docs.splunk.com/Documentation/Splunk/7.2.7/Indexer/Restorearchiveddata
I don't see a way to restore Jul 1 2019 to Sep 1 2019...
Does anyone have a reliable script or process to do this?

0 Karma
1 Solution

Builder

Before you restore frozen buckets, you have to make sure the buckets retirement police was previously setup.
Further information -> https://docs.splunk.com/Documentation/Splunk/7.2.7/Indexer/Setaretirementandarchivingpolicy
If you did not previously setup it, there is no way to restore the frozen data.
If the retirement police is properly setup, the procedure to restore frozen Bucket is:

Restoring a Frozen Bucket
To thaw an archived bucket:
– Copy the bucket directory from the archive to the index's thaweddb directory
– Stop Splunk
– Run splunk rebuild
- Also works to recover a corrupted
- Directory Does not count against license
– Start Splunk
- Data in thaweddb is searchable along with other data, is not frozen, and does not count against index total size
– Delete the bucket directory when no longer needed and restart Splunk

I don't have any script to run the recovery process.

View solution in original post

0 Karma

Builder

Before you restore frozen buckets, you have to make sure the buckets retirement police was previously setup.
Further information -> https://docs.splunk.com/Documentation/Splunk/7.2.7/Indexer/Setaretirementandarchivingpolicy
If you did not previously setup it, there is no way to restore the frozen data.
If the retirement police is properly setup, the procedure to restore frozen Bucket is:

Restoring a Frozen Bucket
To thaw an archived bucket:
– Copy the bucket directory from the archive to the index's thaweddb directory
– Stop Splunk
– Run splunk rebuild
- Also works to recover a corrupted
- Directory Does not count against license
– Start Splunk
- Data in thaweddb is searchable along with other data, is not frozen, and does not count against index total size
– Delete the bucket directory when no longer needed and restart Splunk

I don't have any script to run the recovery process.

View solution in original post

0 Karma

Builder

when I typed the response was missing this part, here is the procedure
To thaw an archived bucket:
– Copy the bucket directory from the archive to the index's thaweddb directory
– Stop Splunk
– Run splunk rebuild path to bucket directory
Also works to recover a corrupted directory
Does not count against license
– Start Splunk
Data in thaweddb is searchable along with other data, is not frozen, and does not
count against index total size
– Delete the bucket directory when no longer needed and restart Splunk

0 Karma

Communicator

thanks, I have 1TB and months of buckets to cp and rebuild.
I found a script and going to try to use it on a non-prod standalone indexer, which I will make a peer later.
If you have any other advice it will be much appreciated.
Thanks

0 Karma