Hi @Kamachi 1/2. You should backup the entire bucket, not just the journal.zst file. The other files make up part of the metadata, signposting and other data which allows Splunk to quickly find the content within the data it needs. When a bucket becomes frozen the metadata files are dropped and you are left with the compressed zst file which contains the raw data. This can be thawed back into Splunk if required (although some potential caveats here but less-so with an AIO instance). This does mean that when buckets are frozen, if you want to keep the frozen buckets somewhere longer then you probably want to remove the metadata files from them. You might find rsync works well for replicating the live-like nature of the filesystem. Check out https://splunk.my.site.com/customer/s/article/Bucket-Life-Cycle-overview which might also help. 3. Place them back where they were backed up from. Your AIO instance of Splunk will find them again once it starts up with the same indexes.conf configuration. 4. The existing backed up data will be accessible again without re-indexing - if you copy the data in whilst Splunk is already running then you will need to restart Splunk. If its done during the VM provisioning then when Splunk starts up you shouldnt need to do anything. I would always recommend trying these things out with, ie create a new VM and attempt the recovery steps to prove this all works correctly. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing
... View more
