topic Why has my cold-to-frozen export script stopped working? in Installation

Why has my cold-to-frozen export script stopped working?

Lowell — Tue, 24 Aug 2010 03:57:21 GMT

I just noticed that my coldToFrozenScript stopped working around about 4.1.4 and all my exports have been failing. The export bucket location does contains no data.

I did some followup testing and tried to run exporttool by hand, and I'm seeing the following message for all my buckets:

no events

My script is based on the flatfileExport.sh.example script provided by splunk.

Any ideas?

Re: Why has my cold-to-frozen export script stopped working?

Lowell — Tue, 24 Aug 2010 04:12:46 GMT

Check to see if your usage of the exportool utility includes meta::all. If it does, remove it. Splunk has apparently deprecated this command line argument.

In the example of the flatfileExport.sh.example, you should change this line:

exporttool "$1" "${1}/index.export" meta::all

should now be:

exporttool "$1" "${1}/index.export"

I have requested that splunk add this to their release changelog.

Re: Why has my cold-to-frozen export script stopped working?

Stephen_Sorkin — Tue, 24 Aug 2010 06:59:58 GMT

Lowell, sorry about this oversight. We have fixed exporttool to restore backwards compatibility for calling arguments. This will ship in 4.1.5.