Deployment Architecture

In version 4.3.+ how can I validate my indexes if I have some problems with my data storage or Splunk going down?

DerekB
Splunk Employee
Splunk Employee

What can be done to validate my indexes if any of the following situations occur:

  • Hard drive failure
  • Server crash
1 Solution

DerekB
Splunk Employee
Splunk Employee

4.3.x should deal with index problems automatically upon restart.
The caveat is that it checks and fixes buckets which were in the process of being built or checked when Splunk went down. It will not check buckets which it thinks it was not building at the time of startup.
This means if they end up with a file system or hardware problem where some of the files get messed up that we weren't altering, they won't be checked automatically, and you'll have to do that manually.
To do this manually, you will need to follow the steps on the fsck command. Here is a helpful link on the steps:
http://wiki.splunk.com/Check_and_Repair_Metadata
This is a related answers question: How to quickly validate the metadata files of a given index and of all its buckets? on Splunk Answers

View solution in original post

DerekB
Splunk Employee
Splunk Employee

4.3.x should deal with index problems automatically upon restart.
The caveat is that it checks and fixes buckets which were in the process of being built or checked when Splunk went down. It will not check buckets which it thinks it was not building at the time of startup.
This means if they end up with a file system or hardware problem where some of the files get messed up that we weren't altering, they won't be checked automatically, and you'll have to do that manually.
To do this manually, you will need to follow the steps on the fsck command. Here is a helpful link on the steps:
http://wiki.splunk.com/Check_and_Repair_Metadata
This is a related answers question: How to quickly validate the metadata files of a given index and of all its buckets? on Splunk Answers

Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...