Can we restore data from one single host?

[arunkuriakose]

Hi 

Is it possible to restore archive data from one single host

consider we have an index=windows ,we want to restore archive data only for one host

ie;index=windows host=xxx . Is it possible someway?

Thanks in advance

[PickleRick]

Restore from where?

Generally, data is kept in buckets and buckets keep some part of events for a given index. There's no differentiation on host, source, sourcetype or other fields level. The only thing that can make events fall into one bucket or another is time (because of quarantine buckets which gather all "out of time" events).

So if you want to thaw a frozen bucket, you can only thaw a whole bucket. You can't choose some part of it.

[isoutamo]

Hi

I suppose that you are talking about restore frozen data to thawed? Unfortunately you must restore whole buckets at a time. There is no way (or at least any supported/easy) to first select data based on host and then thawed it.

r. Ismo