Archive

[Smartstore] Is there a way to manually upload the bucket to smartstore.

rbal_splunk
Splunk Employee
Splunk Employee

We notice that due to some reason some of the buckets never got loaded to the remote store. IS it feasible to upload the bucket manually

Tags (1)
0 Karma

anoopdi
Path Finder

@rbal_splunk Does the manual upload method honors the encryption enabled on SmartStore?

0 Karma

rbal_splunk
Splunk Employee
Splunk Employee

Splunk has Cacheman's endpoint for a bucket requesting it to add the bucket to cachemanager_upload.json
Note:
Repeat the above for every bucket
Restart the indexer
Repeat the above for every indexer

Note : when you upload the bucket and if the bucket was uploaded successfully the splunkd.log:

08-07-2018 21:51:40.124 +0000 INFO CacheManager - cacheId="bid|_introspection~6~8A26F1F7-F89B-48FB-9398-1E9AC7A2235B|" is NOT on on stable storage, will transfer ...
08-07-2018 21:51:40.125 +0000 INFO CacheManager - action=upload, cacheId="bid|_introspection~6~8A26F1F7-F89B-48FB-9398-1E9AC7A2235B|", status=attempting
08-07-2018 21:51:40.473 +0000 INFO CacheManager - action=upload, cacheId="bid|_introspection~6~8A26F1F7-F89B-48FB-9398-1E9AC7A2235B|", status=succeeded, elapsed_ms=349

audit.log:

08-07-2018 21:51:40.125 +0000 INFO AuditLogger - Audit:[timestamp=08-07-2018 21:51:40.125, user=n/a, action=local_bucket_upload, info=started, cache_id="bid|_introspection~6~8A26F1F7-F89B-48FB-9398-1E9AC7A2235B|", prefix=sample/_introspection/db/49/47/6~8A26F1F7-F89B-48FB-9398-1E9AC7A2235B/guidSplunk-8A26F1F7-F89B-48FB-9398-1E9AC7A2235B][n/a]
08-07-2018 21:51:40.473 +0000 INFO AuditLogger - Audit:[timestamp=08-07-2018 21:51:40.473, user=n/a, action=local_bucket_upload, info=completed, cache_id="bid|_introspection~6~8A26F1F7-F89B-48FB-9398-1E9AC7A2235B|", local_dir="/opt/splunk/var/lib/splunk/_introspection/db/db_1532988790_1532988799_6_8A26F1F7-F89B-48FB-9398-1E9AC7A2235B", kb=260, elapsed_ms=349

*Here is an example to uploade multiple bucket *
curl --netrc-file nnfo -k -X POST https://localhost:8089/services/admin/cacheman/_bulk_register -d cache_id="bid|testindex~17~024011E7-E61E-45CE-82DE-732038D5C276|" -d cache_id="bid|testindex~22~024011E7-E61E-45CE-82DE-732038D5C276|" -d cache_id="bid|testindex~28~024011E7-E61E-45CE-82DE-732038D5C276|" -d cache_id="bid|testindex~34~024011E7-E61E-45CE-82DE-732038D5C276|" -d cache_id="bid|testindex~12~E646664A-D351-41E4-BBE7-5B02A08C44C9|" -d cache_id="bid|testindex~17~F876C294-3E3E-488A-8344-16727AC34C52|" -d cache_id="bid|testindex~17~E646664A-D351-41E4-BBE7-5B02A08C44C9|"

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!