Are you a member of the Splunk Community?
- Find Answers
- :
- Splunk Administration
- :
- Admin Other
- :
- Knowledge Management
- :
- Data restore from frozen bucket
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Data restore from frozen bucket
Hi is anyone help me how can i restore data from a frozen bucket to make it searchable in an indexer clustering environment ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi soni i have gone through this document i have an indexer cluster so in any indexer i can login and go to that index and copy the files to the thawdb directory ? Or should i do it in indexer cluater master ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You can thaw the data, by placing the data into the thawed directories of the peer nodes from which it was originally archived. So frozen buckets of indexer1 would be placed in thawdb directory of indexer1 itself. Do this for all the indexers.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
how can i know that this data is archived from which indexer, also whats the location for frozen bucket i am assuming it /var/lib/splunk/(indexer_name)/thaweddb right ? , also after moving the data i need to rebuild it and execute the restart of all indexers ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
look for the GUID that attached to the bucket name and match it to the GUID of the indexer
Community Content Calendar, September edition
Splunkbase Unveils New App Listing Management Public Preview
Leveraging Automated Threat Analysis Across the Splunk Ecosystem
