All Apps and Add-ons

"Merging hot Databases"

theshyster
New Member

I was intending to moving my colddb and thaweddb indexes over and I mixed up the parent folder.
So I ended up moving the folder with all my hot db, while the splunk service was still running.

When I had realized my folly, I decided to move the hot db in their original location, but the service had already recreated db folder and certain config files:
I decided to merge the db folders together, but certain files I chose to not overwrite
Hosts.data
Sources.data
SourceTypes.data
.bucketManifest
.metaManifest
But I fear that certain hot db files may longer be referenced in the newly created config files.

The entire splunk index is striped across 3 indexes so I'm not sure if automatically repairs inconsistencies in the indexes. How can I check if I successfully merged the 2 "hot" db folders back together?

Tags (2)
0 Karma
1 Solution

jbsplunk
Splunk Employee
Splunk Employee

So long as you don't have bucket id conflicts, you should be able to restart splunk and if you're on a version above 4.2, the hot buckets would be rolled to warm. *.data files would be rebuilt when that happens and you can check the .data files for the number of events, earliest, latest, and actual latest event times. You can then search that time range and if you don't end up with a number smaller than this(it could be larger because of time range overlap in buckets), I'd think you should be ok.

View solution in original post

jbsplunk
Splunk Employee
Splunk Employee

So long as you don't have bucket id conflicts, you should be able to restart splunk and if you're on a version above 4.2, the hot buckets would be rolled to warm. *.data files would be rebuilt when that happens and you can check the .data files for the number of events, earliest, latest, and actual latest event times. You can then search that time range and if you don't end up with a number smaller than this(it could be larger because of time range overlap in buckets), I'd think you should be ok.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...