Deployment Architecture

roll all hot buckets

beaumaris
Communicator

I am trying to find a way to roll all of my hot buckets on my 4.1.x system with one command. If I run this form the CLI:

./splunk search "| debug cmd=roll"

It says:

FATAL: Error in 'DebugCommand': Hot dbs rolled out to warm for index=*

And then I still see hot buckets in my indexes. Did this work or did I do this wrong?

Tags (2)
1 Solution

jbsplunk
Splunk Employee
Splunk Employee

In version 4.1.x, you can run the following command to roll the hot DBs to warm:

./splunk _internal call /data/indexes/main/roll-hot-buckets -auth admin:password

http://www.splunk.com/wiki/Community:MoveIndexes

View solution in original post

ppang
Splunk Employee
Splunk Employee

Splunk 4.2.x rolls all hot to warm on every restart.

jsburt
New Member

I tried running this command and get the following errors:

QUERYING: 'https://127.0.0.1:8089/services/data/indexes/main/roll-hot-buckets'
FAILED: '502 Couldn't complete HTTP request: error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert hadshake failure'
Content:

0 Karma

jbsplunk
Splunk Employee
Splunk Employee

If you didn't want to restart, you could use the command listed in my response as well.

0 Karma

jbsplunk
Splunk Employee
Splunk Employee

In version 4.1.x, you can run the following command to roll the hot DBs to warm:

./splunk _internal call /data/indexes/main/roll-hot-buckets -auth admin:password

http://www.splunk.com/wiki/Community:MoveIndexes

View solution in original post

mookiie2005
Communicator

Does this command still work for splunk version 6.2.0?

0 Karma

MuS
SplunkTrust
SplunkTrust
0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.