topic Re: splunk command to repair buckets in Splunk Search

splunk command to repair buckets

kteng2024 — Fri, 24 Mar 2017 03:37:08 GMT

hi,

can i please know the splunk command to rebuild the buckets in a directory . I used splunk rebuild directory_name but not working.

Re: splunk command to repair buckets

somesoni2 — Fri, 24 Mar 2017 03:55:45 GMT

The rebuild command can rebuild one data bucket at a time. DOes your directory_name is full/relative path to your data bucket that you want to rebuild?

Re: splunk command to repair buckets

adonio — Fri, 24 Mar 2017 18:58:18 GMT

are you looking for the fsck command?
https://wiki.splunk.com/Community:PostCrashFsckRepair

Re: splunk command to repair buckets

mbadhusha_splun — Fri, 24 Nov 2017 05:49:46 GMT

Hi,

Splunk built-in "rebuild" command is for single bucket. The indexer automatically deletes the old index and metadata files and rebuilds them. You don't need to delete any files yourself.

You can use the below command to rebuild a single bucket

splunk rebuild (name of the bucket directory)

Refer the below link for more details regarding the same.

https://docs.splunk.com/Documentation/Splunk/7.0.0/Indexer/Bucketissues

Cheers,
Meeran.

Re: splunk command to repair buckets

saramamurthy_sp — Fri, 30 Aug 2019 09:23:44 GMT

You can use the below command to rebuild the buckets, from the raw data file alone.

$plunk_home/bin/splunk rebuild

You can use the fsck command on the indexers to repair them as well.

$plunk_home/bin/splunk fsck repair --all-buckets-all-indexes

his will rebuild hot/warm/cold in all indexes.

If you require it in a single index, then you can use the below command.

$plunk_home/bin/splunk fsck repair --all-buckets-one-index --index-name=

Below is the document which will help you to understand better.

https://docs.splunk.com/Documentation/Splunk/7.3.1/Indexer/Bucketissues