Data restore from frozen bucket

[Prakash493]

Hi is anyone help me how can i restore data from a frozen bucket to make it searchable in an indexer clustering environment ?

[somesoni2]

See this.

https://docs.splunk.com/Documentation/Splunk/7.2.6/Indexer/Restorearchiveddata#Clustered_data_thawin...

[Prakash493]

Hi soni i have gone through this document i have an indexer cluster so in any indexer i can login and go to that index and copy the files to the thawdb directory ? Or should i do it in indexer cluater master ?

[somesoni2]

You can thaw the data, by placing the data into the thawed directories of the peer nodes from which it was originally archived. So frozen buckets of indexer1 would be placed in thawdb directory of indexer1 itself. Do this for all the indexers.

[Prakash493]

how can i know that this data is archived from which indexer, also whats the location for frozen bucket i am assuming it /var/lib/splunk/(indexer_name)/thaweddb right ? , also after moving the data i need to rebuild it and execute the restart of all indexers ?

[adonio]

look for the GUID that attached to the bucket name and match it to the GUID of the indexer