Log restoration process

[Rbsplunk95]

Hello everyone, I am facing some issues with log restoration process from azure cloud to splunk . I have gone through the epoch time conversion process to get the exact date for file. then restore the particular file using the shell commands.

But right now I want to restore two months of log data in splunk. so the previous process is really time taking and there is a chance that we might miss some of the data for a particular time interval.

So is there any way we can restore the two months of date using some prebuild commands or is there any process to ease the task.

Thanks in advance. 

[lkutch_splunk]

Hi,

I'm not sure if this is what you're asking about, but there's a doc on restoring based on internal audit logs: 

https://docs.splunk.com/Documentation/ES/6.4.0/Install/InstallEnterpriseSecuritySHC#Restore_incident...