Deployment Architecture

Restoration of archived logs

garima_chauhan
Path Finder

Hi,

I have been able to restore the archived bucket successfully in Splunk by following the steps mentioned in the Splunk documentation for Windows.

But, the steps state that we have to restore every bucket individually, which will become very tedious in case there are a large number of buckets to be restored, say 100 or more.Is there any way of restoring all the buckets in one go?

Please help.

0 Karma
1 Solution

jtrucks
Splunk Employee
Splunk Employee

Write a script to iterate through the buckets to move them, then at the end of the script, restart Splunk. This is generally how most of us do it.

--
Jesse Trucks
Minister of Magic

View solution in original post

jtrucks
Splunk Employee
Splunk Employee

Write a script to iterate through the buckets to move them, then at the end of the script, restart Splunk. This is generally how most of us do it.

--
Jesse Trucks
Minister of Magic

garima_chauhan
Path Finder

Thanks jtrucks, but I am relatively new to this field, it would be really helpful if you could share the script.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

You may use any script (VBScript/Python) which may allow to your use loops to move all the archived bucket into thaweddb with proper name and then restart the splunk at once.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...