Dashboards & Visualizations

How do you rebuild multiple buckets from frozen to thawed folder in Windows?

arrangineni
Path Finder

Is there a cmd command or script that I can use in Windows to rebuild multiple buckets after copying from frozen to thawed Splunk folder? I am trying to rebuild nearly 150 buckets.

0 Karma
1 Solution

CarsonZa
Contributor

There isnt a built in command but i can share what i have used in the past using powershell.

$SourceFolder = "<thawdb>"

$id = 1000

$folders = Get-ChildItem $SourceFolder

$folders.ForEach({

    $db = ($_.Name -split "_")[0]

    $epoch_start = ($_.Name -split "_")[1]

    $epoch_end = ($_.Name -split "_")[2]

    Rename-Item -Path $_.FullName -NewName "$($db)_$($epoch_start)_$($epoch_end)_$id"

    $id++

})

$files = Get-ChildItem -Path $SourceFolder

cd 'C:\Program Files\Splunk\bin'

foreach($file in $files){

    .\splunk.exe rebuild $SourceFolder\$($file.name)
}

a little explanation, move bucket into your thawdb directory which you will define in the $SourceFolder. The script renames bucket id starting at 1000 to avoid any possible collision issues. Runs rebuild command to thaw buckets. Then restart splunk.

View solution in original post

CarsonZa
Contributor

There isnt a built in command but i can share what i have used in the past using powershell.

$SourceFolder = "<thawdb>"

$id = 1000

$folders = Get-ChildItem $SourceFolder

$folders.ForEach({

    $db = ($_.Name -split "_")[0]

    $epoch_start = ($_.Name -split "_")[1]

    $epoch_end = ($_.Name -split "_")[2]

    Rename-Item -Path $_.FullName -NewName "$($db)_$($epoch_start)_$($epoch_end)_$id"

    $id++

})

$files = Get-ChildItem -Path $SourceFolder

cd 'C:\Program Files\Splunk\bin'

foreach($file in $files){

    .\splunk.exe rebuild $SourceFolder\$($file.name)
}

a little explanation, move bucket into your thawdb directory which you will define in the $SourceFolder. The script renames bucket id starting at 1000 to avoid any possible collision issues. Runs rebuild command to thaw buckets. Then restart splunk.

arrangineni
Path Finder

Thanks, This worked

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...