topic How to rollback buckets from cold to warm? in Deployment Architecture

How to rollback buckets from cold to warm?

joxley — Mon, 19 Jan 2015 13:59:10 GMT

I have recently upgraded my indexer to have two sets of drives. SSDs are mounted on /fast and spinning rust is sitting on /cold. I have configured the indexes to have homePath on the /fast partition and coldPath on the /cold partition.

Because this is a new setup, there is a lot of data in the cold indexes already. I'd like to un-roll the indexes so everything is on the /fast partition and only roll over when it fills up.

Re: How to rollback buckets from cold to warm?

lguinn2 — Tue, 20 Jan 2015 22:20:50 GMT

Here are the steps:

Stop Splunk.
Make a backup of the indexes, to be safe.
Copy all the buckets in the cold directory to the new home directory for each index.
Remove the buckets from the cold directory.
Check the settings in all index.conf files - the default number of warm buckets is 300; if you have not specified a larger number, then you should! For example: maxWarmDBCount = 10000 or a number large enough to fill your /fast partition. Also, you should be using volumes to manage the size of the home directory (hot + warm) to avoid completely filling the disk.
Start Splunk.

Splunk will roll the warm buckets to cold (again) when it either hits the maxWarmDBCount or the volume size for hot/warm.

Re: How to rollback buckets from cold to warm?

Lucas_K — Tue, 20 Jan 2015 22:28:23 GMT

So the deletion of .bucketmanifest is not required anymore? ie. manifests are now checked against existing files upon start up "every time"? I hadn't checked if this was still required in any v6 version.