I have 100's of buckets in thawed path. Can we run the splunk rebuild
command to rebuild all buckets that are moved to thawed path at once or do we need to rebuild by the bucket by bucket basis?
Splunk built-in "rebuild" command is for single bucket. So, you may create script to run multiple buckets rebuild.
Splunk doc recommend to stop Splunk if you run the command in the thawed path.
Or, you rebuild the bucket in temp directory and stop Splunk, move the bucket to thawed path, and Start Splunk.
( ref: https://docs.splunk.com/Documentation/Splunk/6.5.2/Indexer/Restorearchiveddata )
Please be careful of running multiple rebuild because it will require CPU, memory and DISK IO.
Splunk built-in "rebuild" command is for single bucket. So, you may create script to run multiple buckets rebuild.
Splunk doc recommend to stop Splunk if you run the command in the thawed path.
Or, you rebuild the bucket in temp directory and stop Splunk, move the bucket to thawed path, and Start Splunk.
( ref: https://docs.splunk.com/Documentation/Splunk/6.5.2/Indexer/Restorearchiveddata )
Please be careful of running multiple rebuild because it will require CPU, memory and DISK IO.
can you elaborate? where did you restore the buckets from? is this a clustered environment (Indexers)?
we have restored the buckets from external backup disk available. where we have very old buckets (consisting raw data and indexed data). The indexers are clustered.
a clustered bucket carries the unique guid of the instance it was at. make sure the right buckets go back t the right indexers. if these were cold searchable buckets, you just need to place in thawed directory and you are good to go. read more here: https://docs.splunk.com/Documentation/Splunk/6.5.1/Indexer/Restorearchiveddata
Can we place hot buckets from backup in to thawed path to make data searchable.
Can we run the splunk rebuild command to rebuild all buckets that are moved to thawed path at once or do we need to rebuild by the bucket by bucket basis?
will recommend against placing hot buckets - most likely to cause conflicts. You can however try and re-index the data. also, pay attention to the index name and to the Indexer (since its clustered). in order to use the rebuild command, you have to put your cluster in maintenance mode and than stop an indexer and run the command.
I have to ask again, are the buckets archived / frozen? if not (which i think is the case here) its enough to just place them in thawed and you are supposed to see the data.
Again, watch out from these hot buckets