Log into http://cacti.geant.net/cacti/
Locate the graph with the Spike:
Click on the Spanner icon to the right of the graph to determine the name of the Round Robin Database (RRD) file that requires changing.
In this case the rrd file name is /opt/cacti-0.8.7e/rra/mx1_lon_uk_traffic_in_20683.rrd.
Click on the Magnifying Glass icon to the right of the graph and select the time period you wish to zoom into.
Continue 'zooming' until you can determine the date and time range of the Spikes. In the above case one spike occurred on 19/01/2016 and the other on 26/01/2016
Using the Epoch & Unix Timestamp Conversion Tool found at http://www.epochconverter.com/ convert the date/times into their UTC equivalent as Cacti stored its date and time in UTC format.
In this case the UTC ranges are 1453161601 - 1453247999 and 1453766401 - 1453852799. We can also see that the data values are in the range of 3x10e12 (3.0T) and 3.5x10e12 (3.5T)
Log into prod-cacti01-fra-de.geant.net
Change to the /tmp directory
Run rrdtool dump /opt/cacti/rra/<Required Data File>.rrd > /tmp/<Required Data File>.xml