Restore indexed data

[stumbleshoe]

We had an app installed on our Splunk console that created its own index. We've removed the application but wanted to save the data. The indexed data is still around in a 'colddb' but we cannot figure out how to get search to see this data again now that the app has been removed.

[yannK · Accepted solution]

easy method : download the app again and check inside for the indexes.conf
then copy the content in your own indexes.conf in another app or in .../etc/system/local, the restart.

other method :
let's say your old index was named kowabunga and came with 3 folders, the indexes.conf should have been like

[kowabunga]
homePath=$SPLUNK_DB/kowabunga/db
coldPath=$SPLUNK_DB/kowabunga/colddb
thawedPath=$SPLUNK_DB/kowabunga/thaweddb


• create the same index named kowabunga or another name. Using the manager > indexes, or by editing the indexes.conf configuration in an app or in .../etc/system/local, pick the folder location.
• restart to apply if you used the configuration
• if you changed the location/name, simply move the the data from your old homePath (kowabunga/db/) and coldPath (kowabunga/colddb) to the same folders in the new index.
• then restart and search with index=kowabunga
• you can also check the role permissions to search this new index

[stumbleshoe]

That worked! Thanks!