roll all hot buckets

[beaumaris]

I am trying to find a way to roll all of my hot buckets on my 4.1.x system with one command. If I run this form the CLI:

./splunk search "| debug cmd=roll"

It says:

FATAL: Error in 'DebugCommand': Hot dbs rolled out to warm for index=*

And then I still see hot buckets in my indexes. Did this work or did I do this wrong?

[ppang]

Splunk 4.2.x rolls all hot to warm on every restart.

[jsburt]

I tried running this command and get the following errors:

QUERYING: 'https://127.0.0.1:8089/services/data/indexes/main/roll-hot-buckets'
FAILED: '502 Couldn't complete HTTP request: error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert hadshake failure'
Content:

[jbsplunk]

If you didn't want to restart, you could use the command listed in my response as well.

[jbsplunk · Accepted solution]

In version 4.1.x, you can run the following command to roll the hot DBs to warm:

./splunk _internal call /data/indexes/main/roll-hot-buckets -auth admin:password

http://www.splunk.com/wiki/Community:MoveIndexes

[mookiie2005]

Does this command still work for splunk version 6.2.0?

[MuS]

Yes, it does http://docs.splunk.com/Documentation/Splunk/6.2.0/Indexer/Backupindexeddata#Rolling_buckets_manually...