Getting Data In

Is there any guidance on finding the proper frozen bucket I would need for a specific time frame?

seankoniarz
Explorer

Is there any guidance on finding the proper frozen bucket I would need for a specific time frame?  

Labels (1)
0 Karma

Mehran_Safari
Explorer

https://github.com/mehransafari/Splunk_FrozenData_FIND_by_DATE_and_Restore

 

an script for finding frozen bucket files in time range you gave

shows folders + size + start time and endtime of logs contains on  each folder log

+ asks to unfrozen log 

it may help you

0 Karma

saravanan90
Contributor

This small sample script may help you.

#!/usr/bin/bash
mkdir /home/splunk/scripts/
cd /home/splunk/scripts/
echo "Please enter the start date of the required events in (mm/dd/yyyy hh:mi:ss)?"
read Startdate
#Startdate="02/13/2020 00:00:00"
st_epoch=$(date -d "${Startdate}" +"%s")
echo "Please enter the end date of the required events in (mm/dd/yyyy hh:mi:ss)?"
read enddate
#enddate="02/13/2020 18:00:00"
ed_epoch=$(date -d "${enddate}" +"%s")
echo "Please enter the Index Name?"
read index
ed_epoch=$(date -d "${enddate}" +"%s")
#enter your frozen bucket path below
find /opt/splunk/$index/frozendb/db_* -maxdepth 0 -type d > idx.txt
while read line
do
#set the delimeter as per the frozen path
file_st=$(echo $line | cut -d'/' -f6 | cut -d'_' -f3)
file_ed=$(echo $line | cut -d'/' -f6 | cut -d'_' -f2)
if [ $file_ed -lt $ed_epoch -a $file_ed -gt $st_epoch ] || [ $file_st -lt $ed_epoch -a $file_st -gt $st_epoch ]
then
echo "$line" >> /home/splunk/scripts/backup_temp.txt
else
if [ $file_st -le $st_epoch -a $ed_epoch -le $file_ed ]
then
echo "$line" >> /home/splunk/scripts/backup_temp.txt
fi
fi
done < idx.txt

richgalloway
SplunkTrust
SplunkTrust

Buckets are named using the epoch form of the starting and ending times of the event inside it.  Write a script to pull apart the bucket name in your frozen directory and display those that match the specific time frame.  It will speed things up if you know which index you need to look in and have the frozen buckets for each index in separate locations.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...