Deployment Architecture

Roll buckets that are in "Cannot fix search count as the bucket hasn't rolled yet" state

alonsocaio
Contributor

Is there any way to automatically roll buckets that are in the "Cannot fix search count as the bucket hasn't rolled yet" state? Every time that any of my indexers restarts It causes some buckets to stay in fixing mode because they have not rolled yet.

This is causing some impact my Enterprise Security performance, since some of the correlation searches will not run when I have lots of buckets in fixing mode.

0 Karma
1 Solution

codebuilder
Influencer

You can manually roll all hot buckets from hot to warm at the index level:

splunk _internal call /data/indexes/<index_name>/roll-hot-buckets -auth <admin_username>:<admin_password>
----
An upvote would be appreciated and Accept Solution if it helps!

View solution in original post

codebuilder
Influencer

You can manually roll all hot buckets from hot to warm at the index level:

splunk _internal call /data/indexes/<index_name>/roll-hot-buckets -auth <admin_username>:<admin_password>
----
An upvote would be appreciated and Accept Solution if it helps!

alonsocaio
Contributor

Thanks, I guess that this will help me!

0 Karma

muizash
Path Finder

Where to run this command?

0 Karma

codebuilder
Influencer

On the indexers.

----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...