Dashboards & Visualizations

How do you rebuild multiple buckets from frozen to thawed folder in Windows?

arrangineni
Path Finder

Is there a cmd command or script that I can use in Windows to rebuild multiple buckets after copying from frozen to thawed Splunk folder? I am trying to rebuild nearly 150 buckets.

0 Karma
1 Solution

CarsonZa
Contributor

There isnt a built in command but i can share what i have used in the past using powershell.

$SourceFolder = "<thawdb>"

$id = 1000

$folders = Get-ChildItem $SourceFolder

$folders.ForEach({

    $db = ($_.Name -split "_")[0]

    $epoch_start = ($_.Name -split "_")[1]

    $epoch_end = ($_.Name -split "_")[2]

    Rename-Item -Path $_.FullName -NewName "$($db)_$($epoch_start)_$($epoch_end)_$id"

    $id++

})

$files = Get-ChildItem -Path $SourceFolder

cd 'C:\Program Files\Splunk\bin'

foreach($file in $files){

    .\splunk.exe rebuild $SourceFolder\$($file.name)
}

a little explanation, move bucket into your thawdb directory which you will define in the $SourceFolder. The script renames bucket id starting at 1000 to avoid any possible collision issues. Runs rebuild command to thaw buckets. Then restart splunk.

View solution in original post

CarsonZa
Contributor

There isnt a built in command but i can share what i have used in the past using powershell.

$SourceFolder = "<thawdb>"

$id = 1000

$folders = Get-ChildItem $SourceFolder

$folders.ForEach({

    $db = ($_.Name -split "_")[0]

    $epoch_start = ($_.Name -split "_")[1]

    $epoch_end = ($_.Name -split "_")[2]

    Rename-Item -Path $_.FullName -NewName "$($db)_$($epoch_start)_$($epoch_end)_$id"

    $id++

})

$files = Get-ChildItem -Path $SourceFolder

cd 'C:\Program Files\Splunk\bin'

foreach($file in $files){

    .\splunk.exe rebuild $SourceFolder\$($file.name)
}

a little explanation, move bucket into your thawdb directory which you will define in the $SourceFolder. The script renames bucket id starting at 1000 to avoid any possible collision issues. Runs rebuild command to thaw buckets. Then restart splunk.

arrangineni
Path Finder

Thanks, This worked

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...