topic Re: Roll Hot Bucket into warm-Error in Security

Roll Hot Bucket into warm-Error

rajuljain1990 — Wed, 07 Jan 2015 10:36:26 GMT

I am trying to roll hot bucket using following cmd, and it it throwing error ,with http status=503,
Please tell me, where I am doing mistake:
C:\Program Files\Splunk\bin>splunk _internal call /data/indexes/olym/roll-hot-buckets -auth admin:changeme
QUERYING: 'https://127.0.0.1:8089/services/data/indexes/olym/roll-hot-buckets'
FAILED: 'HTTP/1.1 503 Service Unavailable'
Content:

<msg type="ERROR">

In handler 'indexes': could not queue custom action='roll-hot-buckets' for idx=olym

Re: Roll Hot Bucket into warm-Error

MuS — Wed, 07 Jan 2015 11:52:55 GMT

Is your Splunk running and working? run splunk status also check splunkd.log

Re: Roll Hot Bucket into warm-Error

rajuljain1990 — Wed, 07 Jan 2015 12:39:25 GMT

Hi Michael,

Splunk is running and working fine. I am not able to get relevant logs in splunkd.

PS: I am searching the logs in C:\ Program Files\ Splunk\ var\ log\ splunk\ splunkd location. Correct me if I am wrong.

Thanks,
Rajul

Re: Roll Hot Bucket into warm-Error

MuS — Wed, 07 Jan 2015 12:46:14 GMT

Okay, may I ask why you want to do this? If you do it because you want to backup see the docs http://docs.splunk.com/Documentation/Splunk/6.2.1/Indexer/Backupindexeddata and most important this part of it:

Important: It is ordinarily not advisable to roll hot buckets manually, as each forced roll permanently decreases search performance over the data. As a general rule, larger buckets are more efficient to search. By prematurely rolling buckets, you're producing smaller, less efficient buckets. In cases where hot data needs to be backed up, a snapshot backup is the preferred method.

What happens if you try to roll the _internal index like this:

splunk _internal call /data/indexes/_internal/roll-hot-buckets -auth admin:changeme

Re: Roll Hot Bucket into warm-Error

abacus_machine_ — Wed, 07 Jan 2015 12:59:43 GMT

Which version of Splunk you are using?

Re: Roll Hot Bucket into warm-Error

rajuljain1990 — Mon, 28 Sep 2020 18:35:22 GMT

Hi Michael,
I want to do this for R & D purpose. It is my home lab not the critical servers.

I tried it for the index "_internal", it is throwing the same error:

C:\Program Files\Splunk\bin>splunk _internal call /data/indexes/_internal/roll-h
ot-buckets -auth admin:changeme
QUERYING: 'https://127.0.0.1:8089/services/data/indexes/_internal/roll-hot-bucke
ts'
FAILED: 'HTTP/1.1 503 Service Unavailable'
Content:

<msg type="ERROR">

In handler 'indexes': could not queue custom action='roll-hot-buckets' for idx=
_internal

Regards,
Rajul

Re: Roll Hot Bucket into warm-Error

rajuljain1990 — Thu, 08 Jan 2015 05:30:41 GMT

I am using Splunk 6.2.0 (build 237341)

Re: Roll Hot Bucket into warm-Error

melcher — Wed, 14 Sep 2016 18:08:59 GMT

I had a similar issue. I found out that I had actually run out of disk space on the RAID where my indexes were stored. That may be something to look into.