topic Re: snapshot search index in Splunk Search

snapshot search index

PIETRO_CENTANNI — Fri, 30 Oct 2015 16:33:50 GMT

I have a server that works to search-haed and a by search-index . They're virtual machines and before upgrade to search-index I wanted to rate a snap to image. if I comeback with the server by image how indexes behave ?

thanks

Re: snapshot search index

woodcock — Fri, 30 Oct 2015 17:30:01 GMT

Please restate with many more words and sample data with desired sample output.

Re: snapshot search index

martin_mueller — Sun, 01 Nov 2015 00:29:10 GMT

Assuming your snapshot restores the machine to the correct state, the indexes will be fine. To be on the safe side you may want to stop the indexer when making the snapshot, then you won't accidentally snapshot some in-flight data in a bad state. However, even if that happens, the damage would always be contained to that bucket.

Re: snapshot search index

PIETRO_CENTANNI — Mon, 02 Nov 2015 08:29:39 GMT

Today I try to test and I tell you the result.
thanks

Re: snapshot search index

PIETRO_CENTANNI — Mon, 02 Nov 2015 10:01:15 GMT

I am sorry but this test is impossible Because there is the risk of losing dates .
I stop indexer before i make the snapshot , I make the upgrade and after I start by indexer .
If I turn back because there are problems and I copy the my snapshot I lose all the datas in the range time.

Re: snapshot search index

PIETRO_CENTANNI — Mon, 02 Nov 2015 11:41:20 GMT

I was thinking if I can disable forwarding setting inputs.conf in and after I make to the snapshot , make the ugrade , I do various tests without the risk arrive That datas .

[splunktcp://9997]
connection_host = ip
disable = 1

At the End of the test I can REMOVE the disable and receive all date.
this is possible? this is a correct procedures?

Re: snapshot search index

martin_mueller — Mon, 02 Nov 2015 18:05:54 GMT

You should be more specific in your question - a general question gets a general answer, a detailed question gets a detailed answer.

If you snapshot the indexer and let forwarders send data afterwards, that snapshot will not contain this new data. Restoring to the snapshot will restore the state at the time of snapshot, dropping all new data.

Re: snapshot search index

martin_mueller — Mon, 02 Nov 2015 18:07:40 GMT

That would indeed stop forwarders from sending data. Assuming you're able to keep all monitored files around, and can queue all other data such as network sources then yeah, this might work.

As an alternative, in case of problems after the upgrade you could back up new buckets, restore the snapshot, and add in the new buckets from after the upgrade.

Re: snapshot search index

PIETRO_CENTANNI — Tue, 29 Sep 2020 07:45:15 GMT

Thanks Martin for your answers

Yesterday I analyzed the problem. The sending dates is via forwarder and syslog come from port 514. From like you said you monitor all is complicated.

Interesting your suggestion about back up new buckets. I tried to stop indexer for 10 minutes and I see the behavior of the buckets. The folders hot_v1_nnn change in db_nnn and generate new hot_v1_xxx.
But is it then simply add this folder in directory relevant?
Thanks

Re: snapshot search index

martin_mueller — Tue, 03 Nov 2015 12:19:07 GMT

http://www.georgestarcher.com/splunk-success-with-syslog/

When manually copying buckets around you need to be careful to align the bucket IDs to avoid duplicates, so make sure you do that on a testing instance first or get someone who already has done that before.