How can I manually move buckets from WARM to COLD

[cpenkert]

We recently made several indexes.conf file changes, notably changing our bucket size from 5GB to 1GB. Along with this, we changed our MaxHotBuckets and MaxWarmDBCount to align with our new bucket size of 1GB.

As we still have many of our 5GB buckets in our WARM location, we are not reaching our max for WARM buckets, before hitting our MaxTotalDataSizeinMB.

Result = COLD data freezing sooner than we'd like and our HOT/WARM data location filling up.

What is the process for moving WARM buckets to COLD manually?

[gkanapathy]

All you need to do is stop Splunk, then move the buckets from the hot directory to the cold one, the start Splunk. Generally, you move the lowest numbered ones first, but really, you move the ones with the oldest most recent data first.

[BunnyHop]

This might have your answer.

http://answers.splunk.com/questions/664/how-can-i-trigger-migration-of-buckets-from-warm-to-cold

[BunnyHop]

As of right now, and AFAIK, the only manual process you can do to roll buckets is the CLI from Hot to Warm.

[cpenkert]

I was looking for a way to manually do this, rather than manipulate how splunk automatically does it. I ended up going the route suggested in this article and above as I was running into disk full issues.

[yannK]

You can play with the parameter in $SPLUNK_HOME/etc/system/local/indexes.conf

[default] maxWarmDBCount = xxx

[yannK]

http://www.splunk.com/base/Documentation/4.1.5/Admin/Indexesconf

[cpenkert]

I should also note that I don't want to move ALL WARM db's to cold, just select ones.