- Splunk Answers
- :
- Splunk Administration
- :
- Deployment Architecture
- :
- Re: Can we run the "splunk rebuild" command to reb...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have 100's of buckets in thawed path. Can we run the splunk rebuild command to rebuild all buckets that are moved to thawed path at once or do we need to rebuild by the bucket by bucket basis?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Splunk built-in "rebuild" command is for single bucket. So, you may create script to run multiple buckets rebuild.
Splunk doc recommend to stop Splunk if you run the command in the thawed path.
Or, you rebuild the bucket in temp directory and stop Splunk, move the bucket to thawed path, and Start Splunk.
( ref: https://docs.splunk.com/Documentation/Splunk/6.5.2/Indexer/Restorearchiveddata )
Please be careful of running multiple rebuild because it will require CPU, memory and DISK IO.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Splunk built-in "rebuild" command is for single bucket. So, you may create script to run multiple buckets rebuild.
Splunk doc recommend to stop Splunk if you run the command in the thawed path.
Or, you rebuild the bucket in temp directory and stop Splunk, move the bucket to thawed path, and Start Splunk.
( ref: https://docs.splunk.com/Documentation/Splunk/6.5.2/Indexer/Restorearchiveddata )
Please be careful of running multiple rebuild because it will require CPU, memory and DISK IO.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
can you elaborate? where did you restore the buckets from? is this a clustered environment (Indexers)?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
we have restored the buckets from external backup disk available. where we have very old buckets (consisting raw data and indexed data). The indexers are clustered.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
a clustered bucket carries the unique guid of the instance it was at. make sure the right buckets go back t the right indexers. if these were cold searchable buckets, you just need to place in thawed directory and you are good to go. read more here: https://docs.splunk.com/Documentation/Splunk/6.5.1/Indexer/Restorearchiveddata
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Can we place hot buckets from backup in to thawed path to make data searchable.
Can we run the splunk rebuild command to rebuild all buckets that are moved to thawed path at once or do we need to rebuild by the bucket by bucket basis?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
will recommend against placing hot buckets - most likely to cause conflicts. You can however try and re-index the data. also, pay attention to the index name and to the Indexer (since its clustered). in order to use the rebuild command, you have to put your cluster in maintenance mode and than stop an indexer and run the command.
I have to ask again, are the buckets archived / frozen? if not (which i think is the case here) its enough to just place them in thawed and you are supposed to see the data.
Again, watch out from these hot buckets
Introducing Splunk Enterprise 9.2
Adoption of RUM and APM at Splunk
Routing logs with Splunk OTel Collector for Kubernetes
