I received an error when attempting to restore data

If an error occurs, the error is logged to the splunkd.log. When you review the Archive page, if you experience errors, you may want to review the splunkd.log and specify the coldstoragearchiver component here: index=_internal source=*/splunkd.log component=coldstoragearchiver

I clicked the Check Size button and nothing happened

When restoring data, I clicked the Check Size button multiple times and nothing happened.

Diagnosis

When restoring a large amount of data, it may take some time for Splunk to verify that the size of the data can be restored without causing performance issues. If you click the Check Size buttons multiple times, it may trigger AWS to block the check process.

Solution

Do not click the Check Size button multiple times if you don't immediately receive feedback.

I archived some of my data. When I attempted to restore it a few hours later, an error message appeared.

When I archived data and attempted to restore it soon after, I received an error message.

Diagnosis

Data can take up to 48 hours to archive. If you attempt to restore the data before this time period completes, the restoration will fail and the following error message appears: You cannot restore data that was archived less than 48 hours ago. Please try again later.

Solution

Make sure the Recently Archived Data switch in the Restore Data modal is set to Exclude. When set to Exclude, DDAA skips restoration of all data archived within the last 48 hours. See Steps to restore archived data to Splunk Cloud Platform. OR

Wait until the 48 hour threshold has been met, and then attempt to restore the data. You can check the status of the archival process as follows:

• Run the following search against the internal log to determine when Splunk Cloud Platform started the archival process:

index=_internal component=ColdStorageArchiver "Successfully executed archiving script"

I'm trying to restore fully archived data, but I'm still receiving an error message about data archival.

I'm trying to restore data and the archival process completed more than 48 hours ago, but I'm receiving the following error message: You cannot restore data that was archived less than 48 hours ago. Please try again later.

Diagnosis

Receiving this error message after the archival process is complete indicates that there are incorrect timestamps in the data.

Solution

Contact Splunk Technical Support for help with correcting the timestamp data.