Getting Data In

Steps to restor Frozen Data

saeed
Explorer

Hi, (My Splunk Apps are installed on Linux Servers)

I would like to restore logs from frozen data and read them

So please I need the steps to do it.

Labels (1)
0 Karma
1 Solution

saravanan90
Contributor

Copy the directory from frozen directory to thaweddb. Then run the below command

splunk rebuild [path to thawed bucket] 

e.g. splunk rebuilt \opt\splunk\var\lib\splunk\defaultdb\thaweddb\db_1181756465_1162600547_1001

Restart the indexer

https://docs.splunk.com/Documentation/Splunk/8.1.1/Indexer/Restorearchiveddata#.2Anix_users

View solution in original post

saravanan90
Contributor

Copy the directory from frozen directory to thaweddb. Then run the below command

splunk rebuild [path to thawed bucket] 

e.g. splunk rebuilt \opt\splunk\var\lib\splunk\defaultdb\thaweddb\db_1181756465_1162600547_1001

Restart the indexer

https://docs.splunk.com/Documentation/Splunk/8.1.1/Indexer/Restorearchiveddata#.2Anix_users

saeed
Explorer

Thanks a lot

Tags (1)
0 Karma
Get Updates on the Splunk Community!

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...