All Apps and Add-ons

General DB files question.

uayub
Path Finder

There are files such as db_1350734407_1350313059_152-tmp in the defaultdb/db folder.
What are these files ending in tmp? When a search is performed, it seems the data that is in these files are not indexed. How do I tell splunk to index such files?

Thanks for your assistance.
UA

Tags (3)
1 Solution

Rob
Splunk Employee
Splunk Employee

These are temporary files that are created by the online fsck process when Splunk detects a bad index and tries to restore the buckets for that index. They are essentially, a working copy to use for restoring the index until the index has been restored to a good state. Once the -tmp folder has restored all the data for the working copy, it will then replace the same named folder. This is to ensure that data is not lost while the restoration is running.

Sometimes, these -tmp folders can be left behind if the online fsck process exits ungracefully. Generally, it should be safe to delete the folder as it is only a copy of the same named db_* folder in the same directory. The online fsck tool will simply re-create the -tmp folder if it is needed again.

More info on online fsck can be had here: http://wiki.splunk.com/Check_and_Repair_Metadata

View solution in original post

Rob
Splunk Employee
Splunk Employee

These are temporary files that are created by the online fsck process when Splunk detects a bad index and tries to restore the buckets for that index. They are essentially, a working copy to use for restoring the index until the index has been restored to a good state. Once the -tmp folder has restored all the data for the working copy, it will then replace the same named folder. This is to ensure that data is not lost while the restoration is running.

Sometimes, these -tmp folders can be left behind if the online fsck process exits ungracefully. Generally, it should be safe to delete the folder as it is only a copy of the same named db_* folder in the same directory. The online fsck tool will simply re-create the -tmp folder if it is needed again.

More info on online fsck can be had here: http://wiki.splunk.com/Check_and_Repair_Metadata

View solution in original post

.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!