Deployment Architecture

roll all hot buckets

beaumaris
Communicator

I am trying to find a way to roll all of my hot buckets on my 4.1.x system with one command. If I run this form the CLI:

./splunk search "| debug cmd=roll"

It says:

FATAL: Error in 'DebugCommand': Hot dbs rolled out to warm for index=*

And then I still see hot buckets in my indexes. Did this work or did I do this wrong?

Tags (2)
1 Solution

jbsplunk
Splunk Employee
Splunk Employee

In version 4.1.x, you can run the following command to roll the hot DBs to warm:

./splunk _internal call /data/indexes/main/roll-hot-buckets -auth admin:password

http://www.splunk.com/wiki/Community:MoveIndexes

View solution in original post

ppang
Splunk Employee
Splunk Employee

Splunk 4.2.x rolls all hot to warm on every restart.

jsburt
New Member

I tried running this command and get the following errors:

QUERYING: 'https://127.0.0.1:8089/services/data/indexes/main/roll-hot-buckets'
FAILED: '502 Couldn't complete HTTP request: error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert hadshake failure'
Content:

0 Karma

jbsplunk
Splunk Employee
Splunk Employee

If you didn't want to restart, you could use the command listed in my response as well.

0 Karma

jbsplunk
Splunk Employee
Splunk Employee

In version 4.1.x, you can run the following command to roll the hot DBs to warm:

./splunk _internal call /data/indexes/main/roll-hot-buckets -auth admin:password

http://www.splunk.com/wiki/Community:MoveIndexes

mookiie2005
Communicator

Does this command still work for splunk version 6.2.0?

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) v3.54.0

The Splunk Threat Research Team (STRT) recently released Enterprise Security Content Update (ESCU) v3.54.0 and ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

New Learning Videos on Topics Most Requested by You! Plus This Month’s New Splunk ...

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...