Splunk Search

Moving data from stash back to an index?

claudiaG
Engager

Hello all,

following use case:

We wanted to create a backup of some json data. For this we created a new index called  "xyz_backup" and moved all data from the original index to it. By doing that the sourcetype was set to "stash" in the backup index.

Now we want to move the data from the "xyz_backup" index back to the original index. But the sourcetype should be json again and also the field extraction should be back.

By running following command the only thing that happens is that the sourcetype gets set to "json" but the data itself is still not in the right json format (field extractions not working etc.).:

index=xyz_backup
| collect index=original sourcetype=_json

How can we get the data back into its original format (json)?

The original data is still available and could maybe be "read-in" again by resetting the fishbucket but the bad thing is its only possible for individual files right? not for a complete folder? because we have over 100files...

 

Thanks in advance for your help or a quick tip.

Labels (3)
0 Karma
1 Solution

PickleRick
Ultra Champion

I'd suggest going over your source files with a script and resetting fishbucket for those entries to reingest them again.

1. Depending on what you did in your summary-creating search, the stash events contents are simply no longer the same as the original events and short of doing some strange magic to "untangle" it (and for this you have to know exactly what the search did and how it transformed the events) you can't "recreate" the original events. (compare it to making photos of postcards - if you only did photos of the postcard picture, you have no way of knowing what was written on the back).

2. Even if you put in the effort and were able to re-make your jsons, collecting them with any other sourcetype than stash would incure license usage anyway.

So probably the easiest way is to reingest the events from the source.

View solution in original post

0 Karma

PickleRick
Ultra Champion

I'd suggest going over your source files with a script and resetting fishbucket for those entries to reingest them again.

1. Depending on what you did in your summary-creating search, the stash events contents are simply no longer the same as the original events and short of doing some strange magic to "untangle" it (and for this you have to know exactly what the search did and how it transformed the events) you can't "recreate" the original events. (compare it to making photos of postcards - if you only did photos of the postcard picture, you have no way of knowing what was written on the back).

2. Even if you put in the effort and were able to re-make your jsons, collecting them with any other sourcetype than stash would incure license usage anyway.

So probably the easiest way is to reingest the events from the source.

0 Karma
Get Updates on the Splunk Community!

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...

Splunk Observability Cloud | Enhancing Your Onboarding Experience with the ...

We understand that your initial experience with getting data into Splunk Observability Cloud is crucial as it ...