How to use command "splunk resurrect".

[melonman]

Hi,

question about restoration of indexed data. I know how to restore(or search old) indexes data by putting necessary files in a thaweddb.

I would like to know how to use command "splunk resurrect", to restore the index specified period of time by the "splunk resurrect" command.

http://www.splunk.com/base/Documentation/4.1.2/Admin/CLIadmincommands

I am referring to the page above, but I can't get successful result. I would appreciate if you could explain how to use "splunk resurrect" with some example case.

Thank you!

[rroberts · Accepted solution]

From the CLI type... splunk help resurrect. Are you running the command like so....

splunk resurrect /tmp/myarchive/location myindex 01/01/2000:00:00:00 01/01/2001:00:00:00

/tmp/myarchive/location = path to archive file myindex = name of index to resurrect to.