topic Re: Splunk Smartstore : Bucket status in Getting Data In

Splunk Smartstore : Bucket status

samadmemon — Thu, 25 Mar 2021 06:54:34 GMT

Hi All,

We have Indexer cluster configured on AWS EC2 Instances which is configured with Smart store. Since this is a Dev environment we want to stop the EC2 instances in non-business hours.

Could you please advise if the when we stop an indexer with smart store, the hot buckets are rolled to warm and uploaded to the smart store before the indexer peer stops.

Also, what would be the recommended way to stop the splunk service before stopping the EC2 Instance, would it be using splunk stop command or splunk offline command.

Re: Splunk Smartstore : Bucket status

richgalloway — Thu, 25 Mar 2021 15:43:37 GMT

Hot buckets roll to warm when the indexer *starts*, not when it stops.

To upload your data to S2 before stopping, use these steps. They're just my opinion, not based on anything official.

1) Put the indexers into detention. This stops incoming data and prevents new hot buckets.

2) Manually roll each index. See https://docs.splunk.com/Documentation/Splunk/latest/Indexer/Backupindexeddata#Rolling_buckets_manually_from_hot_to_warm

3) Wait for the buckets to upload.

4) Stop the indexers using splunk stop