Deployment Architecture

roll all hot buckets

beaumaris
Communicator

I am trying to find a way to roll all of my hot buckets on my 4.1.x system with one command. If I run this form the CLI:

./splunk search "| debug cmd=roll"

It says:

FATAL: Error in 'DebugCommand': Hot dbs rolled out to warm for index=*

And then I still see hot buckets in my indexes. Did this work or did I do this wrong?

Tags (2)
1 Solution

jbsplunk
Splunk Employee
Splunk Employee

In version 4.1.x, you can run the following command to roll the hot DBs to warm:

./splunk _internal call /data/indexes/main/roll-hot-buckets -auth admin:password

http://www.splunk.com/wiki/Community:MoveIndexes

View solution in original post

ppang
Splunk Employee
Splunk Employee

Splunk 4.2.x rolls all hot to warm on every restart.

jsburt
New Member

I tried running this command and get the following errors:

QUERYING: 'https://127.0.0.1:8089/services/data/indexes/main/roll-hot-buckets'
FAILED: '502 Couldn't complete HTTP request: error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert hadshake failure'
Content:

0 Karma

jbsplunk
Splunk Employee
Splunk Employee

If you didn't want to restart, you could use the command listed in my response as well.

0 Karma

jbsplunk
Splunk Employee
Splunk Employee

In version 4.1.x, you can run the following command to roll the hot DBs to warm:

./splunk _internal call /data/indexes/main/roll-hot-buckets -auth admin:password

http://www.splunk.com/wiki/Community:MoveIndexes

mookiie2005
Communicator

Does this command still work for splunk version 6.2.0?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...