Dashboards & Visualizations

How do you rebuild multiple buckets from frozen to thawed folder in Windows?

arrangineni
Path Finder

Is there a cmd command or script that I can use in Windows to rebuild multiple buckets after copying from frozen to thawed Splunk folder? I am trying to rebuild nearly 150 buckets.

0 Karma
1 Solution

CarsonZa
Contributor

There isnt a built in command but i can share what i have used in the past using powershell.

$SourceFolder = "<thawdb>"

$id = 1000

$folders = Get-ChildItem $SourceFolder

$folders.ForEach({

    $db = ($_.Name -split "_")[0]

    $epoch_start = ($_.Name -split "_")[1]

    $epoch_end = ($_.Name -split "_")[2]

    Rename-Item -Path $_.FullName -NewName "$($db)_$($epoch_start)_$($epoch_end)_$id"

    $id++

})

$files = Get-ChildItem -Path $SourceFolder

cd 'C:\Program Files\Splunk\bin'

foreach($file in $files){

    .\splunk.exe rebuild $SourceFolder\$($file.name)
}

a little explanation, move bucket into your thawdb directory which you will define in the $SourceFolder. The script renames bucket id starting at 1000 to avoid any possible collision issues. Runs rebuild command to thaw buckets. Then restart splunk.

View solution in original post

CarsonZa
Contributor

There isnt a built in command but i can share what i have used in the past using powershell.

$SourceFolder = "<thawdb>"

$id = 1000

$folders = Get-ChildItem $SourceFolder

$folders.ForEach({

    $db = ($_.Name -split "_")[0]

    $epoch_start = ($_.Name -split "_")[1]

    $epoch_end = ($_.Name -split "_")[2]

    Rename-Item -Path $_.FullName -NewName "$($db)_$($epoch_start)_$($epoch_end)_$id"

    $id++

})

$files = Get-ChildItem -Path $SourceFolder

cd 'C:\Program Files\Splunk\bin'

foreach($file in $files){

    .\splunk.exe rebuild $SourceFolder\$($file.name)
}

a little explanation, move bucket into your thawdb directory which you will define in the $SourceFolder. The script renames bucket id starting at 1000 to avoid any possible collision issues. Runs rebuild command to thaw buckets. Then restart splunk.

arrangineni
Path Finder

Thanks, This worked

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...