What is the best practice for restoring from archive?

[the_wolverine]

I have data that was archived that I want to access. How do I go about restoring my archived data so that it is searchable again?

[piebob]

You can restore archived data by moving the archive into the thawed directory, $SPLUNK_HOME/var/lib/splunk/defaultdb/thaweddb.

further details here:

http://www.splunk.com/base/Documentation/latest/Admin/Restorearchiveddata

[the_wolverine · Accepted solution]

Assuming you are doing this in version 4.1, let's say you have the following archived bucket:

db_1274129994_1273525194_0

1. Move the bucket to the designated index's thaweddb. For example, if you are restoring to the main index, move it to: $SPLUNK_HOME/var/lib/splunk/defaultdb/thaweddb

Example:

# cp -r db_1274129994_1273525194_0 $SPLUNK_HOME/var/lib/splunk/defaultdb/thaweddb/temporary-db_1274129994_1273525194_0

• Note that, while unlikely, make sure that there isn't a bucket naming conflict. In other words, there should be no existing bucket with the same name in that directory. If so, rename the bucket by changing the bucket id (in the example above, the bucket id is 0.)

  1. Run the following command from CLI and specify the admin username:password to force Splunk to recognize the restored data.

Example:

 # $SPLUNK_HOME/bin/splunk _internal call /data/indexes/main/rebuild-metadata-and-manifests -auth admin:changeme

[the_wolverine]

There's still a thaweddb in 4.3 so I will assume that this works the same way.

[MuS]

how whould that work on 4.3.x... still this way or did it change and you have to put the bucket somewhere else?