What is the proper way to move buckets from cold to thawed?

[richnavis]

Hello,

What is the proper way to move buckets from cold to thawed? From time to time, we have a reason to keep a particular days worth of data for extended periods of time. Is it ok to simply copy the bucket containing the data from colddb to thawed before it rolls off to frozen?

[ddrillic]

A related thread at How to thaw multiple DB within the Frozen bucket?

To rebuild the buckets they use -

cd /opt/splunk/var/lib/splunk/web_logging/thaweddb ; ls | xargs -i /opt/splunk/bin/splunk rebuild {}

[richnavis]

I read that and am not sure we are trying to achieve the same thing. I'm trying to determine if it is OK to prematurely move buckets from colddb to thawed if we know we want to retain them for long periods of time, and if so, what is the proper way to do that.

[ddrillic]

The "official" procedure is to copy from the frozen bucket to the thawed one and then rebuild it. I would assume that doing it from cold to thawed wouldn't be advised. You can allow the data to reach the frozen bucket and from there you can thaw it. Maybe this way would work for you...