Documentation > Splunk > Admin Manual > Restore archived data

Admin Manual

 


Welcome
What to do first
Start Splunk
Meet Splunk Web and Splunk Apps
Before you configure
Add data and configure inputs
Indexing and event processing
Timestamps
Add and manage users
Manage indexes
Define alerts
Set up backups and retention policies
Configure data security
Set up forwarding and receiving
Deploy to other Splunk instances
Set up distributed search
Manage search jobs
Use Splunk's command line interface (CLI)
Configuration file reference
Troubleshooting

Restore archived data

This documentation does not apply to the most recent version of Splunk. Click here for the latest version.

Restore archived data

Archived data can be restored by moving the archive into the thawed directory, $SPLUNK_HOME/var/lib/splunk/defaultdb/thaweddb. An archive can be restored to Splunk server regardless of operating system with some restrictions -- data generated on 64bit systems is not likely to work well on 32 bit systems, while data cannot be moved from PowerPC or Sparc systems to x86 or x8-64 systems or vice versa. Data in thaweddb is not subject to the server's index aging scheme (hot > warm> cold > frozen). You can put old archived data in thawed for as long as you need. When the data is no longer needed, simply delete it or move it out of thawed.

The details of how to restore archived data depends on how it was archived. You can restore archived data to any index or instance of Splunk, with the caveat that you do not introduce bucket id conflicts to your index. Archived data does not need to be restored to its pre-archival location.

Here is an example of safely moving a previously saved archive bucket to thawed.

First: 

# cp -r db_1181756465_1162600547_0  $SPLUNK_HOME/var/lib/splunk/defaultdb/thaweddb/temporary-db_1181756465_1162600547_0

Note: If the archived db was compressed, be sure to uncompress the contents in the temporary directory.

Next: 

# cd $SPLUNK_HOME/var/lib/splunk/defaultdb/thaweddb/
# mv temporary-db_1181756465_1162600547_0  db_1181756465_1162600547_0

Note: This examples assumes that the bucket id '0' does not conflict with any other bucket in the main (defaultdb) index. If it does, you will have to move the bucket to a non-conflicting ID.

Now, clear the manifests and restart splunkd: 

# cd $SPLUNK_HOME/bin
# ./splunk stop
# rm $SPLUNK_HOME/var/lib/splunk/defaultdb/db/.bucketManifest
# rm $SPLUNK_HOME/var/lib/splunk/defaultdb/db/.metaManifest
# ./splunk start

The contents of your newly thawed buckets should be searchable again.

Retrieved from "http://docs.splunk.com/Documentation/Splunk/4.0.2/Admin/Restorearchiveddata"

This documentation applies to the following versions of Splunk: 4.0 , 4.0.1 , 4.0.2 , 4.0.3 , 4.0.4 , 4.0.5 , 4.0.6 , 4.0.7 , 4.0.8 , 4.0.9 View the Article History for its revisions.


You must be logged into splunk.com in order to post comments. Log in now.

Was this documentation topic helpful?

If you'd like to hear back from us, please provide your email address:

We'd love to hear what you think about this topic or the documentation as a whole. Feedback you enter here will be delivered to the documentation team.

Feedback submitted, thanks!