Getting Data In
Highlighted

What is the best practice for restoring from archive?

Champion

I have data that was archived that I want to access. How do I go about restoring my archived data so that it is searchable again?

Tags (2)
Highlighted

Re: What is the best practice for restoring from archive?

Champion

Assuming you are doing this in version 4.1, let's say you have the following archived bucket:

db_1274129994_1273525194_0

  1. Move the bucket to the designated index's thaweddb. For example, if you are restoring to the main index, move it to: $SPLUNK_HOME/var/lib/splunk/defaultdb/thaweddb

Example:

# cp -r db_1274129994_1273525194_0 $SPLUNK_HOME/var/lib/splunk/defaultdb/thaweddb/temporary-db_1274129994_1273525194_0
  • Note that, while unlikely, make sure that there isn't a bucket naming conflict. In other words, there should be no existing bucket with the same name in that directory. If so, rename the bucket by changing the bucket id (in the example above, the bucket id is 0.)

    1. Run the following command from CLI and specify the admin username:password to force Splunk to recognize the restored data.

Example:

 # $SPLUNK_HOME/bin/splunk _internal call /data/indexes/main/rebuild-metadata-and-manifests -auth admin:changeme

View solution in original post

Highlighted

Re: What is the best practice for restoring from archive?

SplunkTrust
SplunkTrust

how whould that work on 4.3.x... still this way or did it change and you have to put the bucket somewhere else?

0 Karma
Highlighted

Re: What is the best practice for restoring from archive?

Champion

There's still a thaweddb in 4.3 so I will assume that this works the same way.

0 Karma
Highlighted

Re: What is the best practice for restoring from archive?

Splunk Employee
Splunk Employee

You can restore archived data by moving the archive into the thawed directory, $SPLUNK_HOME/var/lib/splunk/defaultdb/thaweddb.

further details here:

http://www.splunk.com/base/Documentation/latest/Admin/Restorearchiveddata