Hello everyone
I currently have a cluster of 2 indexes and also 1 search header mounted on Linux and everything is going well with it, these days what I need is to restore indexed data from 1 year ago, which I have on a disk mounted on the server, I am trying to be able to view that data from my header, but I can't do it, I have done tests like the following:
-I have created a new index called mydb2, so as not to alter my original index (mydb), and I have copied several of the directories that have this name "db_1711654894_1711568541_1281_6C91679A-EBBC-4F09-A710-1CC8C8CA8FDC" to the $SPLUNK_DB/mydb2/db/ directory, when doing this I was not successful
-From the cluster I restarted the 2 indexes, and it didn't work either, but after 2 days, data began to appear, but only the data corresponding to 4 days, however the data directories that I copied to $SPLUNK_DB/mydb2/db/ are several and correspond to 5 months, more days have passed, and I have restarted, and no more data has appeared
Does anyone in the community have knowledge of this? To know how to view historical data that has been restored from a backup
