topic Restore reduced buckets for a index in a cluster in Deployment Architecture

Restore reduced buckets for a index in a cluster

season88481 — Sat, 06 Jun 2020 21:24:25 GMT

Hi everyone,

I am following this Splunk doc regarding how to restore a reduce buckets: https://docs.splunk.com/Documentation/Splunk/latest/Indexer/Reducetsidxdiskusage#Restore_reduced_buckets_to_their_original_state

My questions is how to restore reduced buckets for an entire index?

Will the rebuild buckets be replicated to other peer nodes?

Cheers,
S

Re: Restore reduced buckets for a index in a cluster

s2_splunk — Mon, 15 Jun 2020 19:37:42 GMT

Please refer to this for a command that scopes a rebuild to a whole index.

My assumption is that all buckets still lifecycle-managed by Splunk (which is true for COLD) will be subject to cluster master fixup to meet RF/SF, but you will have to run the rebuild on every peer in your cluster (while it is taken OFFLINE), so - in theory - RF should still be met and full index rebuild will happen as needed as part of normal cluster operations.