Getting Data In

If compressing tsidx files in frozen archives, is it possible to ressurect frozen data without uncompressing?

Splunk Employee
Splunk Employee

In the sample cold to frozen script $SPLUNK_HOME/bin/compressedExport.sh.example, Splunk's tsidx files are gzipped during the freezing process. If this script is used and the bucket needs to be resurrected, can we simply copy the frozen bucket to the myindex/thaweddb directory or use the splunk resurrect command to bring the data back online? Or do the compressed tsidx files need to be uncompressed first?

1 Solution

Splunk Employee
Splunk Employee

The tsidx files must be decompressed for search to work.

The traditional resurrect script was supposed to handle this, but it's in a sad way at the moment. For now, I would suggest simply scripting the decompression of the .tsidx.gz files.

View solution in original post

0 Karma

Splunk Employee
Splunk Employee

The tsidx files must be decompressed for search to work.

The traditional resurrect script was supposed to handle this, but it's in a sad way at the moment. For now, I would suggest simply scripting the decompression of the .tsidx.gz files.

View solution in original post

0 Karma

Super Champion

This refers to Splunk prior to 4.2. (Very old)

Splunk 6.4 has just introduced new features to allow searching of "frozen" buckets (aka buckets with out .tsidx files)

0 Karma

Splunk Employee
Splunk Employee

Thank you, Josh!

0 Karma