Getting Data In

Script for finding frozen data by date range and restore them

Mehran_Safari
Explorer

This is a script for finding frozen bucket files in time range you gave

It shows folders + size + start time and endtime of logs contains on  each folder log + asks to unfrozen log 

 

 

#!/bin/bash
clear
echo  "############################"
echo  "##created.by mehran.safari##"
echo  "##        2022            ##"
echo  "############################"
##############
echo -n " Enter index name to lookup:"
read INAME
####
FROZENPATH="/frozendata"
echo " Default Splunk Frozen Indexes Path is "$FROZENPATH". is it ok? (y to continue or n to give new path):"
read  ANSWER3;
case "$ANSWER3" in
"y")
echo -e "OK Deafult Frozen Index Path Selected.";;
"n")
echo -e "Enter NEW Frozen Index Path:";
read FROZENPATH;;
esac
####
find "$FROZENPATH/$INAME" -type d -iname "db_*" -print > "./frozendb.txt"
echo -n " Enter starting date you need("MM/DD/YYYY HH:MM:SS"):"
read SDATE
echo -n " Enter end date you need("MM/DD/YYYY HH:MM:SS"):"
read EDATE
##############
BSDATE=$(date -d  "$SDATE" +%s)
BEDATE=$(date -d  "$EDATE" +%s)
#############
FILE='./frozendb.txt'
 while read line; do
          LOGSTART=`echo $line | cut -d "_" -f3`;
          LOGEND=`echo $line | cut -d "_" -f2`;
if [[ $BSDATE -le $LOGEND && $BEDATE -gt  $LOGSTART ]]; then
echo -e "******************************"
echo -e "Frozen Log Path You want: $line"
HLOGSTART=`date -d @"$LOGSTART"`
HLOGEND=`date -d @"$LOGEND"`
LOGSIZE=`du -hs "$line" | cut -d "/" -f1`
echo -e "*** this Bucket contains logs from: $HLOGSTART"
echo -e "*** this Bucket contains logs to: $HLOGEND "
echo -e "**** The Size Of This Log Is: $LOGSIZE"
echo -e "$line" >> "./frozenmatched.txt"
echo -e "******************************"
#else
#echo "not in data range you want: $line"
fi
done<$FILE
############
sudo rm -rf "./frozendb.txt"
echo "Do you Want to Unfrozen this Logs?(y to copy): "
read  ANSWER
FILE2='./frozenmatched.txt'
INDEXPATH="/opt/splunk/var/lib/splunk"
DST="$INDEXPATH/$INAME/thaweddb/"
if [[ "$ANSWER" == "y" ]]; then
echo " Default Destination is "$DST". is it ok? (y to continue or n to give new path):"
read  ANSWER2;
case "$ANSWER2" in
"y")
echo -e "OK Deafult Destination Selected.";;
"n")
echo -e "Enter NEW Destination Path:";
read DST;;
esac
while read line2; do
        sudo cp -R "$line2" "$DST"
        echo -e "Executing copy of $line2 to $DST DONE."
	echo -e "$DST$(basename $line2)"
	sudo /opt/splunk/bin/splunk rebuild "$DST$(basename $line2)" $INAME --ignore-read-error
done<$FILE2

fi
sudo rm -rf "./frozenmatched.txt"
##########
echo " Do you want to restart splunk service? (y to continue or n to exit):"
read  ANSWER4;
if [[ "$ANSWER4" == "y" ]]; then
sudo /opt/splunk/bin/splunk restart
fi
##########
echo     "################################"
echo  -e "## GOOD LUCk WITH BEST REGARDS##"
echo     "################################"
#########

 

this is the  github project if you need  https://github.com/mehransafari/Splunk_FrozenData_FIND_by_DATE_and_Restore

it may help you

Labels (1)
Tags (1)
0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...