Getting Data In

Finding proper frozen bucket

seankoniarz
Explorer

Is there any guidance on finding the proper frozen bucket I would need for a specific time frame?  

Labels (1)
0 Karma

saravanan90
Contributor

This small sample script may help you.

#!/usr/bin/bash
mkdir /home/splunk/scripts/
cd /home/splunk/scripts/
echo "Please enter the start date of the required events in (mm/dd/yyyy hh:mi:ss)?"
read Startdate
#Startdate="02/13/2020 00:00:00"
st_epoch=$(date -d "${Startdate}" +"%s")
echo "Please enter the end date of the required events in (mm/dd/yyyy hh:mi:ss)?"
read enddate
#enddate="02/13/2020 18:00:00"
ed_epoch=$(date -d "${enddate}" +"%s")
echo "Please enter the Index Name?"
read index
ed_epoch=$(date -d "${enddate}" +"%s")
#enter your frozen bucket path below
find /opt/splunk/$index/frozendb/db_* -maxdepth 0 -type d > idx.txt
while read line
do
#set the delimeter as per the frozen path
file_st=$(echo $line | cut -d'/' -f6 | cut -d'_' -f3)
file_ed=$(echo $line | cut -d'/' -f6 | cut -d'_' -f2)
if [ $file_ed -lt $ed_epoch -a $file_ed -gt $st_epoch ] || [ $file_st -lt $ed_epoch -a $file_st -gt $st_epoch ]
then
echo "$line" >> /home/splunk/scripts/backup_temp.txt
else
if [ $file_st -le $st_epoch -a $ed_epoch -le $file_ed ]
then
echo "$line" >> /home/splunk/scripts/backup_temp.txt
fi
fi
done < idx.txt

richgalloway
SplunkTrust
SplunkTrust

Buckets are named using the epoch form of the starting and ending times of the event inside it.  Write a script to pull apart the bucket name in your frozen directory and display those that match the specific time frame.  It will speed things up if you know which index you need to look in and have the frozen buckets for each index in separate locations.

---
If this reply helps you, an upvote would be appreciated.
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!