All Apps and Add-ons

General DB files question.

uayub
Path Finder

There are files such as db_1350734407_1350313059_152-tmp in the defaultdb/db folder.
What are these files ending in tmp? When a search is performed, it seems the data that is in these files are not indexed. How do I tell splunk to index such files?

Thanks for your assistance.
UA

Tags (3)
1 Solution

Rob
Splunk Employee
Splunk Employee

These are temporary files that are created by the online fsck process when Splunk detects a bad index and tries to restore the buckets for that index. They are essentially, a working copy to use for restoring the index until the index has been restored to a good state. Once the -tmp folder has restored all the data for the working copy, it will then replace the same named folder. This is to ensure that data is not lost while the restoration is running.

Sometimes, these -tmp folders can be left behind if the online fsck process exits ungracefully. Generally, it should be safe to delete the folder as it is only a copy of the same named db_* folder in the same directory. The online fsck tool will simply re-create the -tmp folder if it is needed again.

More info on online fsck can be had here: http://wiki.splunk.com/Check_and_Repair_Metadata

View solution in original post

Rob
Splunk Employee
Splunk Employee

These are temporary files that are created by the online fsck process when Splunk detects a bad index and tries to restore the buckets for that index. They are essentially, a working copy to use for restoring the index until the index has been restored to a good state. Once the -tmp folder has restored all the data for the working copy, it will then replace the same named folder. This is to ensure that data is not lost while the restoration is running.

Sometimes, these -tmp folders can be left behind if the online fsck process exits ungracefully. Generally, it should be safe to delete the folder as it is only a copy of the same named db_* folder in the same directory. The online fsck tool will simply re-create the -tmp folder if it is needed again.

More info on online fsck can be had here: http://wiki.splunk.com/Check_and_Repair_Metadata

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

How to find the worst searches in your Splunk environment and how to fix them

Everyone knows Splunk is a powerful platform for running searches and doing data analytics. Your ...

Share Your Feedback: On Admin Config Service (ACS)!

Help Us Build a Better Admin Config Service Experience (ACS)   We Want Your Feedback on Admin Config Service ...