Getting Data In

use |delete command to delete data,can I restore the data?

itgrc
Engager

use |delete command to delete data,I know the data just hide,not delete from the disk,can I restore the data?how to restore it?

Tags (1)
0 Karma

kristian_kolb
Ultra Champion

No you can not restore the data, I think, at least not easily. As I've understood it, the delete command will wipe those parts of the .tsidx file that refers to the data you want to delete (but not the data itself).

However, if that is the case, perhaps there is some way of rebuilding the .tsidx from the .gz file?
Isn't that what's being done when thawing frozen buckets, i.e. rebuild?

http://docs.splunk.com/Documentation/Splunk/5.0.2/Indexer/Restorearchiveddata

Anyone got experience from this? Or have I misunderstood how the delete and rebuild commands work on the data?

/K

0 Karma

itgrc
Engager

I had a test,I found the delete command didnot delete the .tsidx,It just move the hot data to a db_1342886374_1342282020_0,just like move to a warm db,but add a lot of other directories,such as deletes.So I think it maybe can restore?????However, I can reindex the data again use the raw data.

0 Karma
Get Updates on the Splunk Community!

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...

4 Ways the Splunk Community Helps You Prepare for .conf25

.conf25 is right around the corner, and whether you’re a first-time attendee or a seasoned Splunker, the ...

Enhance Your Splunk App Development: New Tools & Support

UCC FrameworkAdd-on Builder has been around for quite some time. It helps build Splunk apps faster, but it ...