Deployment Architecture

In version 4.3.+ how can I validate my indexes if I have some problems with my data storage or Splunk going down?

DerekB
Splunk Employee
Splunk Employee

What can be done to validate my indexes if any of the following situations occur:

  • Hard drive failure
  • Server crash
1 Solution

DerekB
Splunk Employee
Splunk Employee

4.3.x should deal with index problems automatically upon restart.
The caveat is that it checks and fixes buckets which were in the process of being built or checked when Splunk went down. It will not check buckets which it thinks it was not building at the time of startup.
This means if they end up with a file system or hardware problem where some of the files get messed up that we weren't altering, they won't be checked automatically, and you'll have to do that manually.
To do this manually, you will need to follow the steps on the fsck command. Here is a helpful link on the steps:
http://wiki.splunk.com/Check_and_Repair_Metadata
This is a related answers question: How to quickly validate the metadata files of a given index and of all its buckets? on Splunk Answers

View solution in original post

DerekB
Splunk Employee
Splunk Employee

4.3.x should deal with index problems automatically upon restart.
The caveat is that it checks and fixes buckets which were in the process of being built or checked when Splunk went down. It will not check buckets which it thinks it was not building at the time of startup.
This means if they end up with a file system or hardware problem where some of the files get messed up that we weren't altering, they won't be checked automatically, and you'll have to do that manually.
To do this manually, you will need to follow the steps on the fsck command. Here is a helpful link on the steps:
http://wiki.splunk.com/Check_and_Repair_Metadata
This is a related answers question: How to quickly validate the metadata files of a given index and of all its buckets? on Splunk Answers

View solution in original post

.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!