https://community.splunk.com/t5/Knowledge-Management/Splunk-locktool-is-not-working-as-per-documentation/m-p/509600#M4637 <P>I'm looking to move some buckets around (as a test for now) and I found this link:</P><P><A href="https://docs.splunk.com/Documentation/Splunk/8.0.5/Troubleshooting/CommandlinetoolsforusewithSupport" target="_blank" rel="noopener">https://docs.splunk.com/Documentation/Splunk/8.0.5/Troubleshooting/CommandlinetoolsforusewithSupport</A></P><P>The locktool seemed like something useful to my scenario as the description reads "<SPAN>If you were to write an external script to copy db buckets in and out of indexes you should acquire&nbsp;locks on the db colddb and thaweddb directories as you are modifying them and release the locks when you are done.</SPAN>".</P><P>I tried to integrate it into my workflow, however, I'm not seeing the expected behaviour with it. Despite the lock being in place for db path, I found that sometimes during my copy operation the tsidx files get changed inside the buckets. I tried locking at various levels (db path, each bucket individually, just tsidx files or a combination of the 3) but I still see this behaviour every now and then.</P><P>I was hoping to achieve this operation without bringing the splunkd service down on my peer nodes.<BR /><BR />Is there something I'm missing here?<BR />I would really appreciate some insight into this.</P> Thu, 16 Jul 2020 20:44:55 GMT iarora 2020-07-16T20:44:55Z https://community.splunk.com/t5/Knowledge-Management/Splunk-locktool-is-not-working-as-per-documentation/m-p/509600#M4637 <P>I'm looking to move some buckets around (as a test for now) and I found this link:</P><P><A href="https://docs.splunk.com/Documentation/Splunk/8.0.5/Troubleshooting/CommandlinetoolsforusewithSupport" target="_blank" rel="noopener">https://docs.splunk.com/Documentation/Splunk/8.0.5/Troubleshooting/CommandlinetoolsforusewithSupport</A></P><P>The locktool seemed like something useful to my scenario as the description reads "<SPAN>If you were to write an external script to copy db buckets in and out of indexes you should acquire&nbsp;locks on the db colddb and thaweddb directories as you are modifying them and release the locks when you are done.</SPAN>".</P><P>I tried to integrate it into my workflow, however, I'm not seeing the expected behaviour with it. Despite the lock being in place for db path, I found that sometimes during my copy operation the tsidx files get changed inside the buckets. I tried locking at various levels (db path, each bucket individually, just tsidx files or a combination of the 3) but I still see this behaviour every now and then.</P><P>I was hoping to achieve this operation without bringing the splunkd service down on my peer nodes.<BR /><BR />Is there something I'm missing here?<BR />I would really appreciate some insight into this.</P> Thu, 16 Jul 2020 20:44:55 GMT https://community.splunk.com/t5/Knowledge-Management/Splunk-locktool-is-not-working-as-per-documentation/m-p/509600#M4637 iarora 2020-07-16T20:44:55Z