Deployment Architecture

What is the proper way to move buckets from cold to thawed?

richnavis
Contributor

Hello,

What is the proper way to move buckets from cold to thawed? From time to time, we have a reason to keep a particular days worth of data for extended periods of time. Is it ok to simply copy the bucket containing the data from colddb to thawed before it rolls off to frozen?

0 Karma

ddrillic
Ultra Champion

A related thread at How to thaw multiple DB within the Frozen bucket?

To rebuild the buckets they use -

cd /opt/splunk/var/lib/splunk/web_logging/thaweddb ; ls | xargs -i /opt/splunk/bin/splunk rebuild {}
0 Karma

richnavis
Contributor

I read that and am not sure we are trying to achieve the same thing. I'm trying to determine if it is OK to prematurely move buckets from colddb to thawed if we know we want to retain them for long periods of time, and if so, what is the proper way to do that.

0 Karma

ddrillic
Ultra Champion

The "official" procedure is to copy from the frozen bucket to the thawed one and then rebuild it. I would assume that doing it from cold to thawed wouldn't be advised. You can allow the data to reach the frozen bucket and from there you can thaw it. Maybe this way would work for you...

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 1 release of new security content via the ...

There's No Place Like Chrome and the Splunk Platform

Watch On DemandMalware. Risky Extensions. Data Exfiltration. End-users are increasingly reliant on browsers to ...

The Great Resilience Quest: 5th Leaderboard Update

The fifth leaderboard update for The Great Resilience Quest is out >> 🏆 Check out the ...