Splunk Enterprise

Restore indexed data

stumbleshoe
New Member

We had an app installed on our Splunk console that created its own index. We've removed the application but wanted to save the data. The indexed data is still around in a 'colddb' but we cannot figure out how to get search to see this data again now that the app has been removed.

Tags (2)
0 Karma
1 Solution

yannK
Splunk Employee
Splunk Employee

easy method : download the app again and check inside for the indexes.conf
then copy the content in your own indexes.conf in another app or in .../etc/system/local, the restart.

other method :
let's say your old index was named kowabunga and came with 3 folders, the indexes.conf should have been like

[kowabunga]
homePath=$SPLUNK_DB/kowabunga/db
coldPath=$SPLUNK_DB/kowabunga/colddb
thawedPath=$SPLUNK_DB/kowabunga/thaweddb

  • create the same index named kowabunga or another name. Using the manager > indexes, or by editing the indexes.conf configuration in an app or in .../etc/system/local, pick the folder location.
  • restart to apply if you used the configuration
  • if you changed the location/name, simply move the the data from your old homePath (kowabunga/db/) and coldPath (kowabunga/colddb) to the same folders in the new index.
  • then restart and search with index=kowabunga
  • you can also check the role permissions to search this new index

View solution in original post

yannK
Splunk Employee
Splunk Employee

easy method : download the app again and check inside for the indexes.conf
then copy the content in your own indexes.conf in another app or in .../etc/system/local, the restart.

other method :
let's say your old index was named kowabunga and came with 3 folders, the indexes.conf should have been like

[kowabunga]
homePath=$SPLUNK_DB/kowabunga/db
coldPath=$SPLUNK_DB/kowabunga/colddb
thawedPath=$SPLUNK_DB/kowabunga/thaweddb

  • create the same index named kowabunga or another name. Using the manager > indexes, or by editing the indexes.conf configuration in an app or in .../etc/system/local, pick the folder location.
  • restart to apply if you used the configuration
  • if you changed the location/name, simply move the the data from your old homePath (kowabunga/db/) and coldPath (kowabunga/colddb) to the same folders in the new index.
  • then restart and search with index=kowabunga
  • you can also check the role permissions to search this new index

stumbleshoe
New Member

That worked! Thanks!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...