rebuilding metrics bucket

Jakfarh — Thu, 19 Sep 2024 06:35:22 GMT

Trying to fix a corruption issue with a _metrics bucket, using the "./splunk rebuild <path> command.
Doing this, i recieve the following WARN "Fsck - Rebuilding entire bucket is not supported for "metric" bucket that has a "stubbed-out" rawdata journal. Only bloomfilter will be build"

How would i rebuild the metrics bucket to fix the error?

Re: rebuilding metrics bucket

tscroggins — Sun, 22 Sep 2024 22:15:51 GMT

Hi @Jakfarh,

How did you identify the corruption?

The rebuild command regenerates tsidx and metadata files from a valid rawdata directory.

By default, metrics indexes have metric.stubOutRawdataJournal = true, and the rawdata journal is truncated when the bucket rolls from hot to warm.

The documentation stresses this point:

Caution: Because setting this attribute to "true" eliminates the data in the rawdata files, those
files can no longer be used in bucket repair operations.

After this occurs, the metrics index bucket is comprised of only the tsidx and metadata files, the loss of which should be mitigated by an appropriate clustering configuration (which disables metric.stubOutRawdataJournal) or a backup solution.

If the tsidx or metadata files are corrupt, you'll need to either address the corruption at the file system or disk level or restore a copy from a backup.

topic Re: rebuilding metrics bucket in Splunk Enterprise

rebuilding metrics bucket

Re: rebuilding metrics bucket