I am trying to find a way to roll all of my hot buckets on my 4.1.x system with one command. If I run this form the CLI:
./splunk search "| debug cmd=roll"
It says:
FATAL: Error in 'DebugCommand': Hot dbs rolled out to warm for index=*
And then I still see hot buckets in my indexes. Did this work or did I do this wrong?
In version 4.1.x, you can run the following command to roll the hot DBs to warm:
./splunk _internal call /data/indexes/main/roll-hot-buckets -auth admin:password
Splunk 4.2.x rolls all hot to warm on every restart.
I tried running this command and get the following errors:
QUERYING: 'https://127.0.0.1:8089/services/data/indexes/main/roll-hot-buckets'
FAILED: '502 Couldn't complete HTTP request: error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert hadshake failure'
Content:
If you didn't want to restart, you could use the command listed in my response as well.
In version 4.1.x, you can run the following command to roll the hot DBs to warm:
./splunk _internal call /data/indexes/main/roll-hot-buckets -auth admin:password
Does this command still work for splunk version 6.2.0?