Deployment Architecture

[Smartstore] Is there a way to manually upload the bucket to smartstore.

rbal_splunk
Splunk Employee
Splunk Employee

We notice that due to some reason some of the buckets never got loaded to the remote store. IS it feasible to upload the bucket manually

Tags (1)
0 Karma

anoopdi
Path Finder

@rbal_splunk Does the manual upload method honors the encryption enabled on SmartStore?

0 Karma

rbal_splunk
Splunk Employee
Splunk Employee

Splunk has Cacheman's endpoint for a bucket requesting it to add the bucket to cachemanager_upload.json
Note:
Repeat the above for every bucket
Restart the indexer
Repeat the above for every indexer

Note : when you upload the bucket and if the bucket was uploaded successfully the splunkd.log:

08-07-2018 21:51:40.124 +0000 INFO CacheManager - cacheId="bid|_introspection~6~8A26F1F7-F89B-48FB-9398-1E9AC7A2235B|" is NOT on on stable storage, will transfer ...
08-07-2018 21:51:40.125 +0000 INFO CacheManager - action=upload, cacheId="bid|_introspection~6~8A26F1F7-F89B-48FB-9398-1E9AC7A2235B|", status=attempting
08-07-2018 21:51:40.473 +0000 INFO CacheManager - action=upload, cacheId="bid|_introspection~6~8A26F1F7-F89B-48FB-9398-1E9AC7A2235B|", status=succeeded, elapsed_ms=349

audit.log:

08-07-2018 21:51:40.125 +0000 INFO AuditLogger - Audit:[timestamp=08-07-2018 21:51:40.125, user=n/a, action=local_bucket_upload, info=started, cache_id="bid|_introspection~6~8A26F1F7-F89B-48FB-9398-1E9AC7A2235B|", prefix=sample/_introspection/db/49/47/6~8A26F1F7-F89B-48FB-9398-1E9AC7A2235B/guidSplunk-8A26F1F7-F89B-48FB-9398-1E9AC7A2235B][n/a]
08-07-2018 21:51:40.473 +0000 INFO AuditLogger - Audit:[timestamp=08-07-2018 21:51:40.473, user=n/a, action=local_bucket_upload, info=completed, cache_id="bid|_introspection~6~8A26F1F7-F89B-48FB-9398-1E9AC7A2235B|", local_dir="/opt/splunk/var/lib/splunk/_introspection/db/db_1532988790_1532988799_6_8A26F1F7-F89B-48FB-9398-1E9AC7A2235B", kb=260, elapsed_ms=349

*Here is an example to uploade multiple bucket *
curl --netrc-file nnfo -k -X POST https://localhost:8089/services/admin/cacheman/_bulk_register -d cache_id="bid|testindex~17~024011E7-E61E-45CE-82DE-732038D5C276|" -d cache_id="bid|testindex~22~024011E7-E61E-45CE-82DE-732038D5C276|" -d cache_id="bid|testindex~28~024011E7-E61E-45CE-82DE-732038D5C276|" -d cache_id="bid|testindex~34~024011E7-E61E-45CE-82DE-732038D5C276|" -d cache_id="bid|testindex~12~E646664A-D351-41E4-BBE7-5B02A08C44C9|" -d cache_id="bid|testindex~17~F876C294-3E3E-488A-8344-16727AC34C52|" -d cache_id="bid|testindex~17~E646664A-D351-41E4-BBE7-5B02A08C44C9|"

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...