Deployment Architecture

Can we run the "splunk rebuild" command to rebuild all buckets that are moved to thawed path?

Contributor

I have 100's of buckets in thawed path. Can we run the splunk rebuild command to rebuild all buckets that are moved to thawed path at once or do we need to rebuild by the bucket by bucket basis?

0 Karma
1 Solution

Splunk Employee
Splunk Employee

Splunk built-in "rebuild" command is for single bucket. So, you may create script to run multiple buckets rebuild.

Splunk doc recommend to stop Splunk if you run the command in the thawed path.
Or, you rebuild the bucket in temp directory and stop Splunk, move the bucket to thawed path, and Start Splunk.
( ref: https://docs.splunk.com/Documentation/Splunk/6.5.2/Indexer/Restorearchiveddata )

Please be careful of running multiple rebuild because it will require CPU, memory and DISK IO.

View solution in original post

Splunk Employee
Splunk Employee

Splunk built-in "rebuild" command is for single bucket. So, you may create script to run multiple buckets rebuild.

Splunk doc recommend to stop Splunk if you run the command in the thawed path.
Or, you rebuild the bucket in temp directory and stop Splunk, move the bucket to thawed path, and Start Splunk.
( ref: https://docs.splunk.com/Documentation/Splunk/6.5.2/Indexer/Restorearchiveddata )

Please be careful of running multiple rebuild because it will require CPU, memory and DISK IO.

View solution in original post

SplunkTrust
SplunkTrust

can you elaborate? where did you restore the buckets from? is this a clustered environment (Indexers)?

0 Karma

Contributor

we have restored the buckets from external backup disk available. where we have very old buckets (consisting raw data and indexed data). The indexers are clustered.

0 Karma

SplunkTrust
SplunkTrust

a clustered bucket carries the unique guid of the instance it was at. make sure the right buckets go back t the right indexers. if these were cold searchable buckets, you just need to place in thawed directory and you are good to go. read more here: https://docs.splunk.com/Documentation/Splunk/6.5.1/Indexer/Restorearchiveddata

0 Karma

Contributor

Can we place hot buckets from backup in to thawed path to make data searchable.
Can we run the splunk rebuild command to rebuild all buckets that are moved to thawed path at once or do we need to rebuild by the bucket by bucket basis?

0 Karma

SplunkTrust
SplunkTrust

will recommend against placing hot buckets - most likely to cause conflicts. You can however try and re-index the data. also, pay attention to the index name and to the Indexer (since its clustered). in order to use the rebuild command, you have to put your cluster in maintenance mode and than stop an indexer and run the command.
I have to ask again, are the buckets archived / frozen? if not (which i think is the case here) its enough to just place them in thawed and you are supposed to see the data.
Again, watch out from these hot buckets

0 Karma