Getting Data In

Cold to frozen script, simply moving to thawed folder- how to genericize?

tedder
Communicator

I want to use the coldToFrozenScript to simply move from cold to my thawed path. Great, my shell script simply contains the following: mv -r "$1" /mnt/thawed/

However, if I use this for multiple indexes, I need to move it to the path for the index: /mnt/thawed/indexname/

How can I genericize this? I mean, I can set an argument, but can I detect the index or the thawedPath easily?

1 Solution

dwaddle
SplunkTrust
SplunkTrust

If you know the index name, say via an argument, then you can ask btool to tell you the thawed path, similar to:

$ splunk cmd btool indexes list main | grep thawedPath
thawedPath = $SPLUNK_DB/defaultdb/thaweddb

BEWARE, btool may not be officially supported right now, or ever.

View solution in original post

jarjoh42
Path Finder

Ha-zaw
A Powershell Script for windows users to thaw multiple buckets.


Set-ExecutionPolicy -ExecutionPolicy Bypass


$Date =  get-date -Format yyyyMMdd


Foreach ($SplunkDBs in Get-ChildItem "D:\Splunk_Indexes\indexA\thaweddb")

    {
         & "c:\Program Files\splunk\bin\splunk.exe" rebuild D:\Splunk_Indexes\indexA\thaweddb\$SplunkDBs


    }

0 Karma

lpolo
Motivator

You can use the search command "dbinspect". For example:
|dbinspect index=main

Cheers,
Lp

0 Karma

dwaddle
SplunkTrust
SplunkTrust

If you know the index name, say via an argument, then you can ask btool to tell you the thawed path, similar to:

$ splunk cmd btool indexes list main | grep thawedPath
thawedPath = $SPLUNK_DB/defaultdb/thaweddb

BEWARE, btool may not be officially supported right now, or ever.

Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...