Is there a way to recover a dataset?

[danielbb]

Someone accidentally deleted a dataset - a lookup from the app's Datasets section. Is there a way to recover it? It's on a standalone search head.

[adonio · Accepted solution]

if you have a backup or splunk diag, go to your last backup or diag.
if not, well, its gone

[danielbb]

And we can trace the deletion via index=_audit <id> action=deleted.