topic Notify Splunkd about a new index after move in Getting Data In

Notify Splunkd about a new index after move

joonradley — Mon, 28 Nov 2011 13:38:06 GMT

Hi,

In my cold to frozen script I copy the bucket to another server. The second server is used to access the older entries for forensic investigation. The buckets are copied from cold on the main server to cold on the secondary server.

In order for Splunk to see the new buckets I need restart Splunk. Needless to say that this is less than optimal.

Is there a REST API command that I can issue that will instruct Splunkd on the secondary server to load the new bucket?

Thx

Joon

Re: Notify Splunkd about a new index after move

lpolo — Mon, 28 Nov 2011 15:02:13 GMT

It will be nice to find out it this is possible. I have the same problem.

Re: Notify Splunkd about a new index after move

lpolo — Mon, 28 Nov 2011 15:51:37 GMT

I have the same problem but only with hot buckets. It will be nice to find out if it possible to move hot buckets without restarting splunk.
I have been able to move cold or warm buckets form one server to another server where the index name is the same on both servers.