Hi,
Our splunk setup stores the indexed data under /data02/tools/splunkdb/prod_vicky_app. We keep only 30 days of data in Splunk db as per below given indexes.conf. Now we have to restore some critical information from September 2015. We have those db in tape backup. We requested our server support team to restore the data under /data02/tools/backup_restore. We would like to restore them without affecting the current data and setup. That data should be able to be searched from search head. Please guide how we can achieve.
indexes.conf
[prod_vicky_app]
homePath = $SPLUNK_DB/prod_vicky_app/db
coldPath = $SPLUNK_DB/prod_vicky_app/colddb
thawedPath = $SPLUNK_DB/prod_vicky_app/thaweddb
maxHotIdleSecs = 172800
maxWarmDBCount = 3
frozenTimePeriodInSecs = 2592000
Thanks,
Vic
↧