Splunk Cloud Platform

Restore frozen data if index is unknown

Nawab
Path Finder

We have an issue where we created a default frozen folder instead of frozen for each index, now we have some data in our frozen folder and we want to resotre it back to searchable data. how can i identify the index name of that data or if i cant identify the index name how to restore it to a random index.

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Frozen data does not know from which index it came so it doesn't matter where you restore it.  Consider creating a "thawddata" index for it.  Of course, users will have to search that index as well as any live indexes.

---
If this reply helps you, Karma would be appreciated.
0 Karma

PickleRick
SplunkTrust
SplunkTrust

On the other hand - if you don't know which buckets come from which index... well, that's too bad. You're most probably gonna restore data from several indexes into a single one. As @richgalloway said - frozen buckets (actually any buckets) don't have anything _inside_ them that would indicate which index they are from. It's where they are placed that decides which index they belong to.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...