topic Re: _thefishbucket empty in Installation

_thefishbucket empty

Branden — Mon, 15 Jun 2020 18:07:45 GMT

Hi. We are migrating our Splunk instance to a new server. We do not want it to re-index a directory that we have as a monitor. It was recommended that I copy over our fishbucket.

I'm looking in /opt/splunk/var/lib/splunk and I see _thefishbucket.dat, but it's empty.

How can I prevent a re-index if my fishbucket is empty?

Thanks!

Re: _thefishbucket empty

ddrillic — Sun, 10 Feb 2019 15:00:10 GMT

@Branden, are you looking at the _thefishbucket on the forwarder?

Re: _thefishbucket empty

martin_mueller — Sun, 10 Feb 2019 16:25:49 GMT

There should be a directory fishbucket, it's not the .dat file.