topic Re: How can I manually move buckets from WARM to COLD in Getting Data In

How can I manually move buckets from WARM to COLD

cpenkert — Fri, 29 Oct 2010 00:30:02 GMT

We recently made several indexes.conf file changes, notably changing our bucket size from 5GB to 1GB. Along with this, we changed our MaxHotBuckets and MaxWarmDBCount to align with our new bucket size of 1GB.

As we still have many of our 5GB buckets in our WARM location, we are not reaching our max for WARM buckets, before hitting our MaxTotalDataSizeinMB.

Result = COLD data freezing sooner than we'd like and our HOT/WARM data location filling up.

What is the process for moving WARM buckets to COLD manually?

Re: How can I manually move buckets from WARM to COLD

cpenkert — Fri, 29 Oct 2010 00:30:37 GMT

I should also note that I don't want to move ALL WARM db's to cold, just select ones.

Re: How can I manually move buckets from WARM to COLD

yannK — Fri, 29 Oct 2010 07:04:56 GMT

You can play with the parameter in $SPLUNK_HOME/etc/system/local/indexes.conf

[default] maxWarmDBCount = xxx

Re: How can I manually move buckets from WARM to COLD

yannK — Fri, 29 Oct 2010 07:05:07 GMT

http://www.splunk.com/base/Documentation/4.1.5/Admin/Indexesconf

Re: How can I manually move buckets from WARM to COLD

BunnyHop — Fri, 29 Oct 2010 08:10:39 GMT

This might have your answer.

http://answers.splunk.com/questions/664/how-can-i-trigger-migration-of-buckets-from-warm-to-cold

Re: How can I manually move buckets from WARM to COLD

cpenkert — Sat, 30 Oct 2010 21:43:34 GMT

I was looking for a way to manually do this, rather than manipulate how splunk automatically does it. I ended up going the route suggested in this article and above as I was running into disk full issues.

Re: How can I manually move buckets from WARM to COLD

BunnyHop — Sun, 31 Oct 2010 02:23:54 GMT

As of right now, and AFAIK, the only manual process you can do to roll buckets is the CLI from Hot to Warm.

Re: How can I manually move buckets from WARM to COLD

gkanapathy — Fri, 12 Nov 2010 16:57:21 GMT

All you need to do is stop Splunk, then move the buckets from the hot directory to the cold one, the start Splunk. Generally, you move the lowest numbered ones first, but really, you move the ones with the oldest most recent data first.