Deployment Architecture
Highlighted

What is the proper way to move buckets from cold to thawed?

Contributor

Hello,

What is the proper way to move buckets from cold to thawed? From time to time, we have a reason to keep a particular days worth of data for extended periods of time. Is it ok to simply copy the bucket containing the data from colddb to thawed before it rolls off to frozen?

0 Karma
Highlighted

Re: What is the proper way to move buckets from cold to thawed?

Ultra Champion

A related thread at How to thaw multiple DB within the Frozen bucket?

To rebuild the buckets they use -

cd /opt/splunk/var/lib/splunk/web_logging/thaweddb ; ls | xargs -i /opt/splunk/bin/splunk rebuild {}
0 Karma
Highlighted

Re: What is the proper way to move buckets from cold to thawed?

Contributor

I read that and am not sure we are trying to achieve the same thing. I'm trying to determine if it is OK to prematurely move buckets from colddb to thawed if we know we want to retain them for long periods of time, and if so, what is the proper way to do that.

0 Karma
Highlighted

Re: What is the proper way to move buckets from cold to thawed?

Ultra Champion

The "official" procedure is to copy from the frozen bucket to the thawed one and then rebuild it. I would assume that doing it from cold to thawed wouldn't be advised. You can allow the data to reach the frozen bucket and from there you can thaw it. Maybe this way would work for you...

0 Karma