Hi,
I've archived indexed data into location "D:\Program Files\Splunk\myfrozenarchive" and now myfrozenarchive folder has to folders
db_1364755264_1356979773_16
db_1364971832_1364756312_15
Both these inturn contain folder called rawdata.
I'm trying to restore this archived data but getting error in one of the steps mentioned in the documentation
Windows users
Here is an example of safely restoring a 4.2+ archive bucket to thawed:
1. Copy your archive bucket to the thawed directory:
> xcopy
D:\MyArchive\db_1181756465_1162600547_0 %SPLUNK_HOME%\var\lib\splunk\defaultdb\thaweddb\/s /e /v
2. Execute the rebuild command on the temporary bucket to rebuild the Splunk
indexes and associated files:
> splunk
rebuild %SPLUNK_HOME%\var\lib\splunk\defaultdb\thaweddb\temp_db_1181756465_1162600547_0
3. Rename the temporary bucket to something that Splunk will recognize:
> cd %SPLUNK_HOME%\var\lib\splunk\defaultdb\thaweddb
> move temp_db_1181756465_1162600547_0 db_1181756465_1162600547_1001
Note: You must choose a bucket id that does not conflict with any other bucket in
the index. This example assumes that the bucket id '1001' is unique for the index.
If it isn't, choose some other, non-conflicting bucket ID.
4. Restart Splunk. Go to %SPLUNK_HOME%\bin and run this command:
> splunk restart
I'm getting following error in the 2nd step while trying to rebuild.
Command:
D:\Program Files\splunk\bin > splunk rebuild “D:\Program Files\splunk\var\lib\splu
nk\defaultdb\thaweddh\temp_db_1364755264_1356979773_16”
ERROR — Error opening ‘D:\Program Files\Splunk\uar\log\splunk\splunkd.log”: The
process cannot access the file because it is being used by another process.
ERROR — Error opening ‘D:\Program Files\Splunk\var\log\splunk\splunkd.log”: The
process cannot access the file because it is being used by another process.
ERROR — Error opening ‘D:\Program Files\Splunk\var\log\splunk\splunkd.log”: The
process cannot access the file because it is being used by another process.
ERROR — Error opening ‘D:\Program Files\Splunk\var\log\splunk\splunkd.log”: The
process cannot access the file because it is being used by another process.
ERROR — Error opening ‘D:\Program Files\Splunk\var\log\splunlc\splunkd.log”: The
process cannot access the file because it is being used by another process.
ERROR — Error opening ‘D:\Program Files\Splunk\var\log\splunk\splunkd.log”: The
process cannot access the file because it is being used by another process.
ERROR — Error opening ‘D:\Program Files\Splunk\var\log\splunk\splunkd.log”: The
process cannot access the file because it is being used by another process.
ERROR — Error opening ‘D:\Program Files\Splunk\var\log\splunk\splunkd.log”: The
process cannot access the file because it is being used by another process.
ERROR — Error opening ‘D:\Program Files\Splunk\var\log\splunk\splunkd.log”: The
process cannot access the file because it is being used by another process.
ERROR — Error opening ‘D:\Program Files\Splunk\var\log\splunk\splunkd.log”: The
process cannot access the file because it is being used by another process.
ERROR — Error opening ‘D:\Program Files\Splunk\var\log\splunk\splunkd.log”: The
process cannot access the file because it is being used by another process.
ERROR — Error opening ‘D:\Program Files\Splunk\var\log\splunk\splunkd.log”: The
process cannot access the file because it is being used by another process.
Error: The path D:\Program Files\Splunk\var\lib\splunk\defaultdb\thaweddb\temp_
db_1364755264_1356979773_16 is not a directory.
Rebuilding bucket failed
Please can any one elaborate 2nd and 3rd steps. Version used : splunk 5.0.2
My thaweddb folder
Thank You.