"Merging hot Databases"

[theshyster]

I was intending to moving my colddb and thaweddb indexes over and I mixed up the parent folder.
So I ended up moving the folder with all my hot db, while the splunk service was still running.

When I had realized my folly, I decided to move the hot db in their original location, but the service had already recreated db folder and certain config files:
I decided to merge the db folders together, but certain files I chose to not overwrite
Hosts.data
Sources.data
SourceTypes.data
.bucketManifest
.metaManifest
But I fear that certain hot db files may longer be referenced in the newly created config files.

The entire splunk index is striped across 3 indexes so I'm not sure if automatically repairs inconsistencies in the indexes. How can I check if I successfully merged the 2 "hot" db folders back together?

[jbsplunk · Accepted solution]

So long as you don't have bucket id conflicts, you should be able to restart splunk and if you're on a version above 4.2, the hot buckets would be rolled to warm. *.data files would be rebuilt when that happens and you can check the .data files for the number of events, earliest, latest, and actual latest event times. You can then search that time range and if you don't end up with a number smaller than this(it could be larger because of time range overlap in buckets), I'd think you should be ok.