Splunk Search

Is there a way to recover a dataset?

danielbb
Motivator

Someone accidentally deleted a dataset - a lookup from the app's Datasets section. Is there a way to recover it? It's on a standalone search head.

Tags (2)
0 Karma
1 Solution

adonio
Ultra Champion

if you have a backup or splunk diag, go to your last backup or diag.
if not, well, its gone

View solution in original post

adonio
Ultra Champion

if you have a backup or splunk diag, go to your last backup or diag.
if not, well, its gone

danielbb
Motivator

And we can trace the deletion via index=_audit <id> action=deleted.

0 Karma
Get Updates on the Splunk Community!

Splunk Cloud | Empowering Splunk Administrators with Admin Config Service (ACS)

Greetings, Splunk Cloud Admins and Splunk enthusiasts! The Admin Configuration Service (ACS) team is excited ...

Tech Talk | One Log to Rule Them All

One log to rule them all: how you can centralize your troubleshooting with Splunk logs We know how important ...

Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through: An introduction to the Splunk Threat ...