I am familiar with the old db bucket naming convention
db_latesttime_earliesttime_idnum
But what's the deal with splunk5/6 clustered buckets naming conventions?
I can tell some dirs use the instance name from $SPLUNK_HOME/splunk/etc/instance.cfg in their name and guessing that's how a replicated bucket keeps its instance name.
For example one difference i see, What does the rb_ prefix mean before some of these buckets?
drwx------ 3 root root 4096 Oct 11 04:25 rb_1410795640_1410470068_3_A44F2765-BC19-4248-8306-8373E48E524F
drwx------ 3 root root 4096 Oct 11 06:11 rb_1410795914_1410486747_3_F3CA4477-E3B7-4D55-A0B8-9FD89D030A75
Also Is it safe to move cold or warm buckets around when in a cluster environment?
rb_ is a replicated bucket. The GUID appearing after the bucket ID (A44* or F3C* in your case) is the GUID of the indexer that received the events initially.
it is safe to move the buckets (assuming splunk is not running) amongst the directories
rb_ is a replicated bucket. The GUID appearing after the bucket ID (A44* or F3C* in your case) is the GUID of the indexer that received the events initially.