Splunk Enterprise

Restore indexed data

stumbleshoe
New Member

We had an app installed on our Splunk console that created its own index. We've removed the application but wanted to save the data. The indexed data is still around in a 'colddb' but we cannot figure out how to get search to see this data again now that the app has been removed.

Tags (2)
0 Karma
1 Solution

yannK
Splunk Employee
Splunk Employee

easy method : download the app again and check inside for the indexes.conf
then copy the content in your own indexes.conf in another app or in .../etc/system/local, the restart.

other method :
let's say your old index was named kowabunga and came with 3 folders, the indexes.conf should have been like

[kowabunga]
homePath=$SPLUNK_DB/kowabunga/db
coldPath=$SPLUNK_DB/kowabunga/colddb
thawedPath=$SPLUNK_DB/kowabunga/thaweddb

  • create the same index named kowabunga or another name. Using the manager > indexes, or by editing the indexes.conf configuration in an app or in .../etc/system/local, pick the folder location.
  • restart to apply if you used the configuration
  • if you changed the location/name, simply move the the data from your old homePath (kowabunga/db/) and coldPath (kowabunga/colddb) to the same folders in the new index.
  • then restart and search with index=kowabunga
  • you can also check the role permissions to search this new index

View solution in original post

yannK
Splunk Employee
Splunk Employee

easy method : download the app again and check inside for the indexes.conf
then copy the content in your own indexes.conf in another app or in .../etc/system/local, the restart.

other method :
let's say your old index was named kowabunga and came with 3 folders, the indexes.conf should have been like

[kowabunga]
homePath=$SPLUNK_DB/kowabunga/db
coldPath=$SPLUNK_DB/kowabunga/colddb
thawedPath=$SPLUNK_DB/kowabunga/thaweddb

  • create the same index named kowabunga or another name. Using the manager > indexes, or by editing the indexes.conf configuration in an app or in .../etc/system/local, pick the folder location.
  • restart to apply if you used the configuration
  • if you changed the location/name, simply move the the data from your old homePath (kowabunga/db/) and coldPath (kowabunga/colddb) to the same folders in the new index.
  • then restart and search with index=kowabunga
  • you can also check the role permissions to search this new index

stumbleshoe
New Member

That worked! Thanks!

0 Karma
Get Updates on the Splunk Community!

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...

Splunk and Fraud

Watch Now!Watch an insightful webinar where we delve into the innovative approaches to solving fraud using the ...