Getting Data In

How to use rsync to move frozen data to another location?

mdtoro
Explorer

I was looking at rsync to move some frozen buckets to another location.  One concern,  if rsync picks up new frozen data still being written  and removes the source file before splunk finishes.

I could add find and mtime but this really slows down rsync.

Concerns?

 

Labels (3)
0 Karma

mdtoro
Explorer

I was thinking it is easier to not touch anything recently created.  Create a list of files at least 2 days old.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

That could work, too.

---
If this reply helps you, Karma would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Consider using lsof to test if the file is still open before moving it.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...