topic Re: Clearing fishbucket in UF in Getting Data In

Will deleting the fish bucket file cause forwarder to send all the old data that is already indexed?

spl_unker — Mon, 02 May 2022 21:30:12 GMT

Hi ,

In one of the OLD UF, fish bucket has occupied the complete disk space and service has been stopped. will deleting the fish bucket file cause forwarder to send all the old data that is already indexed ?

Re: Clearing fishbucket in UF

gcusello — Thu, 24 Feb 2022 13:29:51 GMT

Hi @spl_unker,

yes, all the log files still present in the system and reachable by the inputs.conf stanzas will be indexed again.

Probably the only way is to give more space to the Splunk partition.

Ciao.

Giuseppe

Re: Clearing fishbucket in UF

spl_unker — Thu, 24 Feb 2022 14:37:33 GMT

Thanks for the confirmation @gcusello

Re: Clearing fishbucket in UF

gcusello — Thu, 24 Feb 2022 15:25:36 GMT

Hi @spl_unker,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

Re: Clearing fishbucket in UF

impurush — Mon, 02 May 2022 21:20:55 GMT

Hi @gcusello,

Is there any mechanism to clear the entries from the fish bucket after some time or let's say if I set the limit in the fish bucket, which part of the fish bucket gets reduced to like 1 GB fish bucket, and if I set 500 MB and what would be deleted?

Increasing the space for the fish bucket is not the solution I am looking for because it may not have the entries from the old as the retention period in the server is less but the number of rotated files is more.

Re: Clearing fishbucket in UF

gcusello — Tue, 03 May 2022 06:30:09 GMT

Hi @impurush,

you can find how to clean the fishbucket in this answer https://community.splunk.com/t5/Getting-Data-In/How-to-reindex-data-from-a-forwarder/m-p/93310

Ciao.

Giuseppe