Getting Data In

Restoring specific source from frozen


Hello guys,

we need to restore frozen data, however is it possible to choose which source to restore (not all sources), if yes, how?


0 Karma


when thawing (restoring) frozen data, you're limited to the name of the index, and the time range of the bucket(s) of that index you want to restore.
You can find details on how to do this in the "Restore archived indexed data" doc.

Hope that helps - if it does I'd be happy if you would upvote/accept this answer, so others could profit from it. 🙂

Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...