Is there a cmd command or script that I can use in Windows to rebuild multiple buckets after copying from frozen to thawed Splunk folder? I am trying to rebuild nearly 150 buckets.
There isnt a built in command but i can share what i have used in the past using powershell.
$SourceFolder = "<thawdb>"
$id = 1000
$folders = Get-ChildItem $SourceFolder
$folders.ForEach({
$db = ($_.Name -split "_")[0]
$epoch_start = ($_.Name -split "_")[1]
$epoch_end = ($_.Name -split "_")[2]
Rename-Item -Path $_.FullName -NewName "$($db)_$($epoch_start)_$($epoch_end)_$id"
$id++
})
$files = Get-ChildItem -Path $SourceFolder
cd 'C:\Program Files\Splunk\bin'
foreach($file in $files){
.\splunk.exe rebuild $SourceFolder\$($file.name)
}
a little explanation, move bucket into your thawdb directory which you will define in the $SourceFolder. The script renames bucket id starting at 1000 to avoid any possible collision issues. Runs rebuild command to thaw buckets. Then restart splunk.
There isnt a built in command but i can share what i have used in the past using powershell.
$SourceFolder = "<thawdb>"
$id = 1000
$folders = Get-ChildItem $SourceFolder
$folders.ForEach({
$db = ($_.Name -split "_")[0]
$epoch_start = ($_.Name -split "_")[1]
$epoch_end = ($_.Name -split "_")[2]
Rename-Item -Path $_.FullName -NewName "$($db)_$($epoch_start)_$($epoch_end)_$id"
$id++
})
$files = Get-ChildItem -Path $SourceFolder
cd 'C:\Program Files\Splunk\bin'
foreach($file in $files){
.\splunk.exe rebuild $SourceFolder\$($file.name)
}
a little explanation, move bucket into your thawdb directory which you will define in the $SourceFolder. The script renames bucket id starting at 1000 to avoid any possible collision issues. Runs rebuild command to thaw buckets. Then restart splunk.
Thanks, This worked