We had an app installed on our Splunk console that created its own index. We've removed the application but wanted to save the data. The indexed data is still around in a 'colddb' but we cannot figure out how to get search to see this data again now that the app has been removed.
easy method : download the app again and check inside for the indexes.conf
then copy the content in your own indexes.conf in another app or in .../etc/system/local, the restart.
other method :
let's say your old index was named kowabunga and came with 3 folders, the indexes.conf should have been like
[kowabunga]
homePath=$SPLUNK_DB/kowabunga/db
coldPath=$SPLUNK_DB/kowabunga/colddb
thawedPath=$SPLUNK_DB/kowabunga/thaweddb
easy method : download the app again and check inside for the indexes.conf
then copy the content in your own indexes.conf in another app or in .../etc/system/local, the restart.
other method :
let's say your old index was named kowabunga and came with 3 folders, the indexes.conf should have been like
[kowabunga]
homePath=$SPLUNK_DB/kowabunga/db
coldPath=$SPLUNK_DB/kowabunga/colddb
thawedPath=$SPLUNK_DB/kowabunga/thaweddb
That worked! Thanks!