Getting Data In

Is there any guidance on finding the proper frozen bucket I would need for a specific time frame?

seankoniarz
Explorer

Is there any guidance on finding the proper frozen bucket I would need for a specific time frame?  

Labels (1)
0 Karma

Mehran_Safari
Explorer

https://github.com/mehransafari/Splunk_FrozenData_FIND_by_DATE_and_Restore

 

an script for finding frozen bucket files in time range you gave

shows folders + size + start time and endtime of logs contains on  each folder log

+ asks to unfrozen log 

it may help you

0 Karma

saravanan90
Contributor

This small sample script may help you.

#!/usr/bin/bash
mkdir /home/splunk/scripts/
cd /home/splunk/scripts/
echo "Please enter the start date of the required events in (mm/dd/yyyy hh:mi:ss)?"
read Startdate
#Startdate="02/13/2020 00:00:00"
st_epoch=$(date -d "${Startdate}" +"%s")
echo "Please enter the end date of the required events in (mm/dd/yyyy hh:mi:ss)?"
read enddate
#enddate="02/13/2020 18:00:00"
ed_epoch=$(date -d "${enddate}" +"%s")
echo "Please enter the Index Name?"
read index
ed_epoch=$(date -d "${enddate}" +"%s")
#enter your frozen bucket path below
find /opt/splunk/$index/frozendb/db_* -maxdepth 0 -type d > idx.txt
while read line
do
#set the delimeter as per the frozen path
file_st=$(echo $line | cut -d'/' -f6 | cut -d'_' -f3)
file_ed=$(echo $line | cut -d'/' -f6 | cut -d'_' -f2)
if [ $file_ed -lt $ed_epoch -a $file_ed -gt $st_epoch ] || [ $file_st -lt $ed_epoch -a $file_st -gt $st_epoch ]
then
echo "$line" >> /home/splunk/scripts/backup_temp.txt
else
if [ $file_st -le $st_epoch -a $ed_epoch -le $file_ed ]
then
echo "$line" >> /home/splunk/scripts/backup_temp.txt
fi
fi
done < idx.txt

richgalloway
SplunkTrust
SplunkTrust

Buckets are named using the epoch form of the starting and ending times of the event inside it.  Write a script to pull apart the bucket name in your frozen directory and display those that match the specific time frame.  It will speed things up if you know which index you need to look in and have the frozen buckets for each index in separate locations.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...