How to roll HOT to WARM in 4.2?

[Jason]

I saw an answer from last year about a possible new command ./splunk bucket-maint - it seems to be there, but there is zero documentation on it.

What is the proper way to force a roll of all buckets in index x from hot to warm (indexer migration, backups, etc) in 4.2?

[piebob · Accepted solution]

as described in the docs, the command for rolling buckets manually from hot to warm is

./splunk _internal call /data/indexes/<index_name>/roll-hot-buckets –auth <admin_username>:<admin_password>

see: http://www.splunk.com/base/Documentation/latest/Admin/Backupindexeddata#Rolling_buckets_manually_fro...

[jrodman]

The _internal call is just a manual way to hit the roll endpoint, so it should work until we maybe someday change the REST interface to request this, or change the '_internal' command somehow (more likely). You could achieve the same thing with wget.
bucket-maint was added as a friendlier interface, a real command.

[Jason]

Confirmed, this 4.1.x command does work as expected in 4.2.

[Jason]

Okay, I'll go with the 4.1.x method for now. Bucket-maint is mentioned by Josh here: http://answers.splunk.com/questions/2473/

[piebob]

we'll look into the bucket-maint command you heard about, though 🙂