Deployment Architecture

Can we run the "splunk rebuild" command to rebuild all buckets that are moved to thawed path?

ankithreddy777
Contributor

I have 100's of buckets in thawed path. Can we run the splunk rebuild command to rebuild all buckets that are moved to thawed path at once or do we need to rebuild by the bucket by bucket basis?

0 Karma
1 Solution

Masa
Splunk Employee
Splunk Employee

Splunk built-in "rebuild" command is for single bucket. So, you may create script to run multiple buckets rebuild.

Splunk doc recommend to stop Splunk if you run the command in the thawed path.
Or, you rebuild the bucket in temp directory and stop Splunk, move the bucket to thawed path, and Start Splunk.
( ref: https://docs.splunk.com/Documentation/Splunk/6.5.2/Indexer/Restorearchiveddata )

Please be careful of running multiple rebuild because it will require CPU, memory and DISK IO.

View solution in original post

Masa
Splunk Employee
Splunk Employee

Splunk built-in "rebuild" command is for single bucket. So, you may create script to run multiple buckets rebuild.

Splunk doc recommend to stop Splunk if you run the command in the thawed path.
Or, you rebuild the bucket in temp directory and stop Splunk, move the bucket to thawed path, and Start Splunk.
( ref: https://docs.splunk.com/Documentation/Splunk/6.5.2/Indexer/Restorearchiveddata )

Please be careful of running multiple rebuild because it will require CPU, memory and DISK IO.

adonio
Ultra Champion

can you elaborate? where did you restore the buckets from? is this a clustered environment (Indexers)?

0 Karma

ankithreddy777
Contributor

we have restored the buckets from external backup disk available. where we have very old buckets (consisting raw data and indexed data). The indexers are clustered.

0 Karma

adonio
Ultra Champion

a clustered bucket carries the unique guid of the instance it was at. make sure the right buckets go back t the right indexers. if these were cold searchable buckets, you just need to place in thawed directory and you are good to go. read more here: https://docs.splunk.com/Documentation/Splunk/6.5.1/Indexer/Restorearchiveddata

0 Karma

ankithreddy777
Contributor

Can we place hot buckets from backup in to thawed path to make data searchable.
Can we run the splunk rebuild command to rebuild all buckets that are moved to thawed path at once or do we need to rebuild by the bucket by bucket basis?

0 Karma

adonio
Ultra Champion

will recommend against placing hot buckets - most likely to cause conflicts. You can however try and re-index the data. also, pay attention to the index name and to the Indexer (since its clustered). in order to use the rebuild command, you have to put your cluster in maintenance mode and than stop an indexer and run the command.
I have to ask again, are the buckets archived / frozen? if not (which i think is the case here) its enough to just place them in thawed and you are supposed to see the data.
Again, watch out from these hot buckets

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...