Hello,
I have a pretty big case that I started working on locally on a single user instance, using Autopsy directly for the ingestion.
Now I need to perform some queries on the indexed data that SOLR can perform but unfortunately are not directly exposed in the Autopsy GUI: for instance, I need to search the indexed data using boolean operators.
Since this is not directly implemented in Autopsy, I was considering the idea of making a copy of the indexed data and import it into a standalone SOLR server instance.
Is it possible to accomplish this?
I’ve tried spinning up a SOLR instance and copying the content of keywordsearch/solr8/data/* directory into a newly created collection, but I receive errors that the index is not usable
rg.apache.solr.common.SolrException:org.apache.solr.common.SolrException: unexpected docvalues type NONE for field '_version_' (expected=NUMERIC). Re-index with correct docvalues type.
Is it possible to accomplish what i’m trying to do, or I need to surrender myself at the idea of configuring a multy user environment and reindex the whole case?
Are there other alternative solutions i can use? like interacting directly with SOLR from Autopsy when the case is open?
AFAIK SOLR running from within autopsy is not directly accessible from a web GUI? it’s not running as a “service” ?
I can consider the idea of re-ingesting the case data from scratch if that’s the only way possible, but is it even possible to use a solr server without setting up a whole stack for multyuser? I don’t want to setup postgres and activeMQ
thanks in advance,