I am attempting to recover from a hard crash, through no fault of Splunk's. Is it possible to unzip /rawdata/journal.gz and import that raw data back into a new index? I had multiple indexes, so there are are multiple folders with rawdata/journal.gz in them. Just looking to unzip them all into 1 index.
Adam has the good answer here, but to be explicit: you cannot uncompress journal.gz and re-compress it sanely. slices.dat and journal.gz must agree and both must exist.
If you somehow encounter a corruption mid-journal.gz and need to perform partial recovery because it's hugely important data and you have no backups (!!) and are willing to spend many hours on the problem, get in touch directly (username) or via support.
Generally Splunk shouldn't be capable of generating such a problem as we don't modify these files, so any such problem would have to be OS or hardware faults.
Found this question whilst searching for the same answer - thought I'd give the answer now I've worked it out.
In my case I had a journal.gz but had no idea where it came from originally.
i) Create a directory for the bucket:
ii) Copy in the journal.gz
iii) Now run rebuild
iv) Determine the bucket name. We can get this from the tsidx files.
Gives
The format is db_max_min_uniqid where
Thus we get:
v) Copy this directory into the target indexes thaweddb directory. I created an index called recovered so:
vi) Run:
Wait a short while and then run a search on your new index.
I was trying to follow this step with Splunk6.0.2, but it did not work. Any chance since this question answered?