Splunk Cloud Platform

Restore frozen data if index is unknown

Nawab
Path Finder

We have an issue where we created a default frozen folder instead of frozen for each index, now we have some data in our frozen folder and we want to resotre it back to searchable data. how can i identify the index name of that data or if i cant identify the index name how to restore it to a random index.

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Frozen data does not know from which index it came so it doesn't matter where you restore it.  Consider creating a "thawddata" index for it.  Of course, users will have to search that index as well as any live indexes.

---
If this reply helps you, Karma would be appreciated.
0 Karma

PickleRick
SplunkTrust
SplunkTrust

On the other hand - if you don't know which buckets come from which index... well, that's too bad. You're most probably gonna restore data from several indexes into a single one. As @richgalloway said - frozen buckets (actually any buckets) don't have anything _inside_ them that would indicate which index they are from. It's where they are placed that decides which index they belong to.

0 Karma
Get Updates on the Splunk Community!

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...

Splunk and Fraud

Watch Now!Watch an insightful webinar where we delve into the innovative approaches to solving fraud using the ...