What are steps to retrieve frozen data and make it searchable again? Can I specify specific data (date) to be retrieved?

[abdullah_osail]

What are the steps to retrieve frozen data and make it searchable again? Can I specify specific data (date) to be retrieved?
What about the size of logs is it going to be changed after data roll from cold to frozen?!

[Mehran_Safari]

https://github.com/mehransafari/Splunk_FrozenData_FIND_by_DATE_and_Restore

an script for finding frozen bucket files in time range you gave

shows folders + size + start time and endtime of logs contains on  each folder log

it may help you

[mstjohn_splunk]

Hi @abdullah.osail@aramco.com , sorry you aren't getting a bunch of responses! Did you figure out how to solve your problem on your own? Maybe add some more details about your problem to the post. Our users just love more data. Good luck!

[deepashri_123]

Hey@abdullah,

Refer this doc:
https://docs.splunk.com/Documentation/Splunk/7.1.2/Indexer/Restorearchiveddata

Let me know if this helps!!