Hi Guys,

We are using:
6.1.2.0 RD (Build 12)

Recently we were requested to restore some old event data from the
backup logs for one of our collectors.

Scenario:
We have the old logs from our backups.
We have the file collector up and running.
I went to Edit file collector, and in the Start behavior and offset,
inside, Resume from saved data, in current offset I see that it pointing
to the latest file which it had collected, with a number of 140616.log

Now the backup files that I have are with number prior to this file.

Questions:
- Is there any way I would be able to edit this offset and enter in the
number/name of my desired file?
- Or as per my understanding, I would need to create a new file
collector and point it to the new location where these files from backup
would be restored?
- Or what would be the best way for me to restore these old events form
the logs?

Any pointers, help, suggestions highly appreciated!
-ddgaikwad


--
ddgaikwad
------------------------------------------------------------------------
ddgaikwad's Profile: https://forums.netiq.com/member.php?userid=5917
View this thread: https://forums.netiq.com/showthread.php?t=51106