"should I do in chunk"? - Yes, use the date ranges to reduce your date range and restore in multiple chunks. No it will not "reindex it" - https://docs.splunk.com/Documentation/SplunkCloud/9.1.23...
See more...
"should I do in chunk"? - Yes, use the date ranges to reduce your date range and restore in multiple chunks. No it will not "reindex it" - https://docs.splunk.com/Documentation/SplunkCloud/9.1.2308/Admin/DataArchiver#Restore_archived_data_to_Splunk_Cloud_Platform You can use the "check size" button to make sure your span is under your entitlement. Remember Dynamic Data Active Archive (DDAA) it is 10% of your Dynamic Data Active Searchable (DDAS), NOT your daily ingest entitlement. Check "cloud monitoring console> license usage > storage summary" Span too wide! too many buckets!: shorten the span, now i can restore!: reduce your chunk size to under your limit, restore that data, search it, then in the table below you can clear it and restore you next chunk. Data quality matters here, as if your timestamps are all over the place it can be suprizing how many buckets you have to restore to bring back any give date. it will not take multiple days to restore this. if you just shrink your window you can do it in steps. restore > search (tip use collect command to help move what you want to another index) > clear restore > repeat