Archive

How do you rebuild multiple buckets from frozen to thawed folder in Windows?

Path Finder

Is there a cmd command or script that I can use in Windows to rebuild multiple buckets after copying from frozen to thawed Splunk folder? I am trying to rebuild nearly 150 buckets.

0 Karma
1 Solution

Contributor

There isnt a built in command but i can share what i have used in the past using powershell.

$SourceFolder = "<thawdb>"

$id = 1000

$folders = Get-ChildItem $SourceFolder

$folders.ForEach({

    $db = ($_.Name -split "_")[0]

    $epoch_start = ($_.Name -split "_")[1]

    $epoch_end = ($_.Name -split "_")[2]

    Rename-Item -Path $_.FullName -NewName "$($db)_$($epoch_start)_$($epoch_end)_$id"

    $id++

})

$files = Get-ChildItem -Path $SourceFolder

cd 'C:\Program Files\Splunk\bin'

foreach($file in $files){

    .\splunk.exe rebuild $SourceFolder\$($file.name)
}

a little explanation, move bucket into your thawdb directory which you will define in the $SourceFolder. The script renames bucket id starting at 1000 to avoid any possible collision issues. Runs rebuild command to thaw buckets. Then restart splunk.

View solution in original post

Contributor

There isnt a built in command but i can share what i have used in the past using powershell.

$SourceFolder = "<thawdb>"

$id = 1000

$folders = Get-ChildItem $SourceFolder

$folders.ForEach({

    $db = ($_.Name -split "_")[0]

    $epoch_start = ($_.Name -split "_")[1]

    $epoch_end = ($_.Name -split "_")[2]

    Rename-Item -Path $_.FullName -NewName "$($db)_$($epoch_start)_$($epoch_end)_$id"

    $id++

})

$files = Get-ChildItem -Path $SourceFolder

cd 'C:\Program Files\Splunk\bin'

foreach($file in $files){

    .\splunk.exe rebuild $SourceFolder\$($file.name)
}

a little explanation, move bucket into your thawdb directory which you will define in the $SourceFolder. The script renames bucket id starting at 1000 to avoid any possible collision issues. Runs rebuild command to thaw buckets. Then restart splunk.

View solution in original post

Path Finder

Thanks, This worked

0 Karma