Deployment Architecture
Highlighted

Roll buckets that are in "Cannot fix search count as the bucket hasn't rolled yet" state

Communicator

Is there any way to automatically roll buckets that are in the "Cannot fix search count as the bucket hasn't rolled yet" state? Every time that any of my indexers restarts It causes some buckets to stay in fixing mode because they have not rolled yet.

This is causing some impact my Enterprise Security performance, since some of the correlation searches will not run when I have lots of buckets in fixing mode.

0 Karma
Highlighted

Re: Roll buckets that are in "Cannot fix search count as the bucket hasn't rolled yet" state

Motivator

You can manually roll all hot buckets from hot to warm at the index level:

splunk _internal call /data/indexes/<index_name>/roll-hot-buckets -auth <admin_username>:<admin_password>

View solution in original post

0 Karma
Highlighted

Re: Roll buckets that are in "Cannot fix search count as the bucket hasn't rolled yet" state

Communicator

Thanks, I guess that this will help me!

0 Karma
Highlighted

Re: Roll buckets that are in "Cannot fix search count as the bucket hasn't rolled yet" state

Path Finder

Where to run this command?

0 Karma
Highlighted

Re: Roll buckets that are in "Cannot fix search count as the bucket hasn't rolled yet" state

Motivator

On the indexers.

0 Karma