Deployment Architecture

How can you add/move a bucket without restarting splunkd?

Lowell
Super Champion

How do you get splunk to recognize new buckets without restarting splunkd? This makes the process of restoring or moving buckets between indexed more time consuming.

If I remember correctly, this was possible in Splunk 3.4.x by simply copying a bucket into the db or thaweddb folder (as long as you used an atomic move operation), but Splunk 4.0 doesn't seem to automatically detect new buckets the same way. (I noticed that dbinspect seems to see changes immediately, but searches do not.)

Tags (2)
1 Solution

jrodman
Splunk Employee
Splunk Employee

Rough first take:

  1. In the <indexname>/db directory, delete the file .bucketmanifest
  2. In the <indexname>/db directory, create the file (0 bytes works) meta.dirty

If we get into goat sacrifice territory, try also deleting .metamanifest. Step 2 should render that unnecessary. These files and their associated data should get rebuilt on need by search activity.

View solution in original post

jrodman
Splunk Employee
Splunk Employee

Rough first take:

  1. In the <indexname>/db directory, delete the file .bucketmanifest
  2. In the <indexname>/db directory, create the file (0 bytes works) meta.dirty

If we get into goat sacrifice territory, try also deleting .metamanifest. Step 2 should render that unnecessary. These files and their associated data should get rebuilt on need by search activity.

Lowell
Super Champion

Thanks! That worked.

I noticed that .bucketManifest was not recreated automatically, and the the bucket was not added in .metaManifest. When do these get updated?

Get Updates on the Splunk Community!

What’s New in Splunk Cloud Platform 9.1.2308?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2308! Analysts can ...

Index This | Why do they call it hyper text?

November 2023 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

State of Splunk Careers 2023: Career Resilience and the Continued Value of Splunk

For the past three years, Splunk has partnered with Enterprise Strategy Group to conduct a survey that gauges ...