For instance, data generated onĦ4-bit systems is not likely to work well on 32-bit systems, and dataĬannot be moved from Sparc systems or PowerPC to x86 or x86-64 You can also restore a pre-4.2 bucket to an indexer with any operating.You can restore a 4.2+ bucket to an indexer with any operating system.Pre-4.2 bucket to indexer’s in pre-4.2 or post-4.2 versions. Aside from a few OS-related issues described next, you can restore a.You can restore 4.2+ buckets to any 4.2+ instance.Restore a bucket indexed in Splunk Enterprise 4.2 or later to a pre-4.2 Since the bucket data format changed from 4.1 to 4.2, you cannot.However, there are some restrictions and factors that govern this. It’s important to remember that the process to restore archived data is different depending on what version of Splunk Enterprise the data was originally indexed and we discussed this in our blog titled How to archive indexed data in Splunk Enterprise.īroadly speaking, you can restore an archive to any instance of the indexer. If you no longer need the thawed data, you can delete it manually or just move it out of thawed state. Thawed data doesn’t go through the aging process (hot, warm, cold, frozen) and is never deleted by default. $SPLUNK_HOME/var/lib/splunk/defaultdb/thaweddb/* To restore archived data, you move it to the thawed directory. This blog will cover details on how to restore archived data in Splunk Enterprise. Data that has been archived can be returned to the index by thawing it. We covered how to archive indexed data in Splunk here. Data in the frozen stage can either be archived or deleted permanently. We explained how data progresses from Hot to Warm to Cold to Frozen and Thawed stages. In our previous blog titled How data ages in Splunk, we discussed the different stages that data goes through. Specialty of Service-oriented Architecture.
0 Comments
Leave a Reply. |
Details
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |