Splunk Enterprise

Restore indexed data

stumbleshoe
New Member

We had an app installed on our Splunk console that created its own index. We've removed the application but wanted to save the data. The indexed data is still around in a 'colddb' but we cannot figure out how to get search to see this data again now that the app has been removed.

Tags (2)
0 Karma
1 Solution

yannK
Splunk Employee
Splunk Employee

easy method : download the app again and check inside for the indexes.conf
then copy the content in your own indexes.conf in another app or in .../etc/system/local, the restart.

other method :
let's say your old index was named kowabunga and came with 3 folders, the indexes.conf should have been like

[kowabunga]
homePath=$SPLUNK_DB/kowabunga/db
coldPath=$SPLUNK_DB/kowabunga/colddb
thawedPath=$SPLUNK_DB/kowabunga/thaweddb

  • create the same index named kowabunga or another name. Using the manager > indexes, or by editing the indexes.conf configuration in an app or in .../etc/system/local, pick the folder location.
  • restart to apply if you used the configuration
  • if you changed the location/name, simply move the the data from your old homePath (kowabunga/db/) and coldPath (kowabunga/colddb) to the same folders in the new index.
  • then restart and search with index=kowabunga
  • you can also check the role permissions to search this new index

View solution in original post

yannK
Splunk Employee
Splunk Employee

easy method : download the app again and check inside for the indexes.conf
then copy the content in your own indexes.conf in another app or in .../etc/system/local, the restart.

other method :
let's say your old index was named kowabunga and came with 3 folders, the indexes.conf should have been like

[kowabunga]
homePath=$SPLUNK_DB/kowabunga/db
coldPath=$SPLUNK_DB/kowabunga/colddb
thawedPath=$SPLUNK_DB/kowabunga/thaweddb

  • create the same index named kowabunga or another name. Using the manager > indexes, or by editing the indexes.conf configuration in an app or in .../etc/system/local, pick the folder location.
  • restart to apply if you used the configuration
  • if you changed the location/name, simply move the the data from your old homePath (kowabunga/db/) and coldPath (kowabunga/colddb) to the same folders in the new index.
  • then restart and search with index=kowabunga
  • you can also check the role permissions to search this new index

stumbleshoe
New Member

That worked! Thanks!

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...