topic roll all hot buckets in Deployment Architecture

roll all hot buckets

beaumaris — Tue, 26 Jul 2011 18:51:29 GMT

I am trying to find a way to roll all of my hot buckets on my 4.1.x system with one command. If I run this form the CLI:

./splunk search "| debug cmd=roll"

It says:

FATAL: Error in 'DebugCommand': Hot dbs rolled out to warm for index=*

And then I still see hot buckets in my indexes. Did this work or did I do this wrong?

jbsplunk — Tue, 26 Jul 2011 18:54:35 GMT

In version 4.1.x, you can run the following command to roll the hot DBs to warm:

./splunk _internal call /data/indexes/main/roll-hot-buckets -auth admin:password

ppang — Tue, 11 Oct 2011 02:49:05 GMT

Splunk 4.2.x rolls all hot to warm on every restart.

jbsplunk — Tue, 11 Oct 2011 15:29:50 GMT

If you didn't want to restart, you could use the command listed in my response as well.

mookiie2005 — Tue, 10 Mar 2015 19:21:55 GMT

Does this command still work for splunk version 6.2.0?

jsburt — Tue, 29 Sep 2020 06:56:01 GMT

I tried running this command and get the following errors:

QUERYING: 'https://127.0.0.1:8089/services/data/indexes/main/roll-hot-buckets'
FAILED: '502 Couldn't complete HTTP request: error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert hadshake failure'
Content:

MuS — Wed, 24 Aug 2016 04:02:59 GMT