How do you get splunk to recognize new buckets without restarting splunkd? This makes the process of restoring or moving buckets between indexed more time consuming.
If I remember correctly, this was possible in Splunk 3.4.x by simply copying a bucket into the db
or thaweddb
folder (as long as you used an atomic move operation), but Splunk 4.0 doesn't seem to automatically detect new buckets the same way. (I noticed that dbinspect
seems to see changes immediately, but searches do not.)
Rough first take:
If we get into goat sacrifice territory, try also deleting .metamanifest. Step 2 should render that unnecessary. These files and their associated data should get rebuilt on need by search activity.
Rough first take:
If we get into goat sacrifice territory, try also deleting .metamanifest. Step 2 should render that unnecessary. These files and their associated data should get rebuilt on need by search activity.
Thanks! That worked.
I noticed that .bucketManifest
was not recreated automatically, and the the bucket was not added in .metaManifest
. When do these get updated?