Old data cannot load

[Eshmin]

Splunk can not load old data only load current data. Though it shows event count. Before that I have moved some splunk cold db folder  in several times to free up space . and it worked fine. I dont understand what happend now. Is there any way to recover data without splunk search? Installed in windows.

[Eshmin]

Sorry for my little knowledge about it. Is there any way to get expert help for data recovery Live chat or whatsApp number? Actually I have urgency to recover last month specific data.

without search is there any way to load file in CSV format? coz it shows event count 😞

[Eshmin]

Anyone there help me to recover data? I am willing to pay.

[SinghK]

Did you manually move tsidx files??

[Eshmin]

I have move folder from cold db. like the folders which was generated September month. and yes its contain tsidx file.

[isoutamo]

Disclaimer: I haven't try this with myself, so you no warranty are given and you are doing this with your own risk!

If I understood right you are moving some cold data, not frozen data? I suppose that you have only one instance as all-in-one setup (indexer, search head at the same node). If it's this way then basically you should restore the situation by

1. Stop splunk
2. Take backup of your DB_HOME 
3. Add need space for that old data under DB_HOME
4. Move/copy old data to it's original place
5. Start splunk

Another option could be that you manage it as thawed data and restore it to thaweddb directory for that index.  Basically there shouldn't be need to rebuild that dir as you have moved those files without removing metadata from it. Anyhow You should stop your splunk instance and do actions when it's down. 

When you are starting it look what kind of errors you will gotten to splunkd.log. Especially if it cannot start.

r. Ismo

[SinghK]

https://community.splunk.com/t5/Monitoring-Splunk/Restore-archived-data/m-p/76301

if this does not help open case with support.