Is there any guidance on finding the proper frozen bucket I would need for a specific time frame?

[seankoniarz]

Is there any guidance on finding the proper frozen bucket I would need for a specific time frame?  

[Mehran_Safari]

https://github.com/mehransafari/Splunk_FrozenData_FIND_by_DATE_and_Restore

an script for finding frozen bucket files in time range you gave

shows folders + size + start time and endtime of logs contains on  each folder log

+ asks to unfrozen log 

it may help you

[saravanan90]

This small sample script may help you.

#!/usr/bin/bash
mkdir /home/splunk/scripts/
cd /home/splunk/scripts/
echo "Please enter the start date of the required events in (mm/dd/yyyy hh:mi:ss)?"
read Startdate
#Startdate="02/13/2020 00:00:00"
st_epoch=$(date -d "${Startdate}" +"%s")
echo "Please enter the end date of the required events in (mm/dd/yyyy hh:mi:ss)?"
read enddate
#enddate="02/13/2020 18:00:00"
ed_epoch=$(date -d "${enddate}" +"%s")
echo "Please enter the Index Name?"
read index
ed_epoch=$(date -d "${enddate}" +"%s")
#enter your frozen bucket path below
find /opt/splunk/$index/frozendb/db_* -maxdepth 0 -type d > idx.txt
while read line
do
#set the delimeter as per the frozen path
file_st=$(echo $line | cut -d'/' -f6 | cut -d'_' -f3)
file_ed=$(echo $line | cut -d'/' -f6 | cut -d'_' -f2)
if [ $file_ed -lt $ed_epoch -a $file_ed -gt $st_epoch ] || [ $file_st -lt $ed_epoch -a $file_st -gt $st_epoch ]
then
echo "$line" >> /home/splunk/scripts/backup_temp.txt
else
if [ $file_st -le $st_epoch -a $ed_epoch -le $file_ed ]
then
echo "$line" >> /home/splunk/scripts/backup_temp.txt
fi
fi
done < idx.txt

[richgalloway]

Buckets are named using the epoch form of the starting and ending times of the event inside it.  Write a script to pull apart the bucket name in your frozen directory and display those that match the specific time frame.  It will speed things up if you know which index you need to look in and have the frozen buckets for each index in separate locations.