Getting Data In

If compressing tsidx files in frozen archives, is it possible to ressurect frozen data without uncompressing?

hulahoop
Splunk Employee
Splunk Employee

In the sample cold to frozen script $SPLUNK_HOME/bin/compressedExport.sh.example, Splunk's tsidx files are gzipped during the freezing process. If this script is used and the bucket needs to be resurrected, can we simply copy the frozen bucket to the myindex/thaweddb directory or use the splunk resurrect command to bring the data back online? Or do the compressed tsidx files need to be uncompressed first?

1 Solution

jrodman
Splunk Employee
Splunk Employee

The tsidx files must be decompressed for search to work.

The traditional resurrect script was supposed to handle this, but it's in a sad way at the moment. For now, I would suggest simply scripting the decompression of the .tsidx.gz files.

View solution in original post

0 Karma

jrodman
Splunk Employee
Splunk Employee

The tsidx files must be decompressed for search to work.

The traditional resurrect script was supposed to handle this, but it's in a sad way at the moment. For now, I would suggest simply scripting the decompression of the .tsidx.gz files.

0 Karma

Lowell
Super Champion

This refers to Splunk prior to 4.2. (Very old)

Splunk 6.4 has just introduced new features to allow searching of "frozen" buckets (aka buckets with out .tsidx files)

0 Karma

hulahoop
Splunk Employee
Splunk Employee

Thank you, Josh!

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...