Getting Data In

Notify Splunkd about a new index after move

joonradley
Path Finder

Hi,

In my cold to frozen script I copy the bucket to another server. The second server is used to access the older entries for forensic investigation. The buckets are copied from cold on the main server to cold on the secondary server.

In order for Splunk to see the new buckets I need restart Splunk. Needless to say that this is less than optimal.

Is there a REST API command that I can issue that will instruct Splunkd on the secondary server to load the new bucket?

Thx

Joon

Tags (2)
0 Karma

lpolo
Motivator

I have the same problem but only with hot buckets. It will be nice to find out if it possible to move hot buckets without restarting splunk.
I have been able to move cold or warm buckets form one server to another server where the index name is the same on both servers.

0 Karma

lpolo
Motivator

It will be nice to find out it this is possible. I have the same problem.

0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...