Getting Data In

Notify Splunkd about a new index after move

joonradley
Path Finder

Hi,

In my cold to frozen script I copy the bucket to another server. The second server is used to access the older entries for forensic investigation. The buckets are copied from cold on the main server to cold on the secondary server.

In order for Splunk to see the new buckets I need restart Splunk. Needless to say that this is less than optimal.

Is there a REST API command that I can issue that will instruct Splunkd on the secondary server to load the new bucket?

Thx

Joon

Tags (2)
0 Karma

lpolo
Motivator

I have the same problem but only with hot buckets. It will be nice to find out if it possible to move hot buckets without restarting splunk.
I have been able to move cold or warm buckets form one server to another server where the index name is the same on both servers.

0 Karma

lpolo
Motivator

It will be nice to find out it this is possible. I have the same problem.

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!