topic Search Bucket ID Range in Splunk Search

Search Bucket ID Range

ephemeric — Tue, 22 May 2012 18:58:02 GMT

Greetz,

Is it possible to search a range of bucket ids?

I have moved a lot of warm/cold buckets and scrubbed the ids and would like to do this search to get an event count and compare to the count prior to moving the buckets on the old Splunk instance.

Thank you.

Re: Search Bucket ID Range

sowings — Thu, 01 Aug 2013 15:48:23 GMT

Sort of. When you run a search, there's a field called _bkt that gets populated with the bucket's directory name. You'd first have to get the time endpoints for the search from the buckets themselves. The first 10-digit number in a bucket's directory name is the "latestTime" in epoch, and the second 10-digit number is the earliestTime epoch. Take the max and min of those respectively to determine your overall range for the range of buckets. Next, search over a custom time range (you should be able to enter an epoch time in the time picker), then rename _bkt to something without a leading (e.g. "bucket") , and then you should be able to stats count by bucket, or other search-y things like that.

Re: Search Bucket ID Range

ephemeric — Tue, 06 Aug 2013 11:35:06 GMT

Thank you.