Deployment Architecture

[Smartstore] Is there a way to manually upload the bucket to smartstore.

rbal_splunk
Splunk Employee
Splunk Employee

We notice that due to some reason some of the buckets never got loaded to the remote store. IS it feasible to upload the bucket manually

Tags (1)
0 Karma

anoopdi
Path Finder

@rbal_splunk Does the manual upload method honors the encryption enabled on SmartStore?

0 Karma

rbal_splunk
Splunk Employee
Splunk Employee

Splunk has Cacheman's endpoint for a bucket requesting it to add the bucket to cachemanager_upload.json
Note:
Repeat the above for every bucket
Restart the indexer
Repeat the above for every indexer

Note : when you upload the bucket and if the bucket was uploaded successfully the splunkd.log:

08-07-2018 21:51:40.124 +0000 INFO CacheManager - cacheId="bid|_introspection~6~8A26F1F7-F89B-48FB-9398-1E9AC7A2235B|" is NOT on on stable storage, will transfer ...
08-07-2018 21:51:40.125 +0000 INFO CacheManager - action=upload, cacheId="bid|_introspection~6~8A26F1F7-F89B-48FB-9398-1E9AC7A2235B|", status=attempting
08-07-2018 21:51:40.473 +0000 INFO CacheManager - action=upload, cacheId="bid|_introspection~6~8A26F1F7-F89B-48FB-9398-1E9AC7A2235B|", status=succeeded, elapsed_ms=349

audit.log:

08-07-2018 21:51:40.125 +0000 INFO AuditLogger - Audit:[timestamp=08-07-2018 21:51:40.125, user=n/a, action=local_bucket_upload, info=started, cache_id="bid|_introspection~6~8A26F1F7-F89B-48FB-9398-1E9AC7A2235B|", prefix=sample/_introspection/db/49/47/6~8A26F1F7-F89B-48FB-9398-1E9AC7A2235B/guidSplunk-8A26F1F7-F89B-48FB-9398-1E9AC7A2235B][n/a]
08-07-2018 21:51:40.473 +0000 INFO AuditLogger - Audit:[timestamp=08-07-2018 21:51:40.473, user=n/a, action=local_bucket_upload, info=completed, cache_id="bid|_introspection~6~8A26F1F7-F89B-48FB-9398-1E9AC7A2235B|", local_dir="/opt/splunk/var/lib/splunk/_introspection/db/db_1532988790_1532988799_6_8A26F1F7-F89B-48FB-9398-1E9AC7A2235B", kb=260, elapsed_ms=349

*Here is an example to uploade multiple bucket *
curl --netrc-file nnfo -k -X POST https://localhost:8089/services/admin/cacheman/_bulk_register -d cache_id="bid|testindex~17~024011E7-E61E-45CE-82DE-732038D5C276|" -d cache_id="bid|testindex~22~024011E7-E61E-45CE-82DE-732038D5C276|" -d cache_id="bid|testindex~28~024011E7-E61E-45CE-82DE-732038D5C276|" -d cache_id="bid|testindex~34~024011E7-E61E-45CE-82DE-732038D5C276|" -d cache_id="bid|testindex~12~E646664A-D351-41E4-BBE7-5B02A08C44C9|" -d cache_id="bid|testindex~17~F876C294-3E3E-488A-8344-16727AC34C52|" -d cache_id="bid|testindex~17~E646664A-D351-41E4-BBE7-5B02A08C44C9|"

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...