How do you rebuild multiple buckets from frozen to thawed folder in Windows?

[arrangineni]

Is there a cmd command or script that I can use in Windows to rebuild multiple buckets after copying from frozen to thawed Splunk folder? I am trying to rebuild nearly 150 buckets.

[CarsonZa · Accepted solution]

There isnt a built in command but i can share what i have used in the past using powershell.

$SourceFolder = "<thawdb>"

$id = 1000

$folders = Get-ChildItem $SourceFolder

$folders.ForEach({

    $db = ($_.Name -split "_")[0]

    $epoch_start = ($_.Name -split "_")[1]

    $epoch_end = ($_.Name -split "_")[2]

    Rename-Item -Path $_.FullName -NewName "$($db)_$($epoch_start)_$($epoch_end)_$id"

    $id++

})

$files = Get-ChildItem -Path $SourceFolder

cd 'C:\Program Files\Splunk\bin'

foreach($file in $files){

    .\splunk.exe rebuild $SourceFolder\$($file.name)
}

a little explanation, move bucket into your thawdb directory which you will define in the $SourceFolder. The script renames bucket id starting at 1000 to avoid any possible collision issues. Runs rebuild command to thaw buckets. Then restart splunk.

[arrangineni]

Thanks, This worked