Getting Data In

Notify Splunkd about a new index after move

Path Finder

Hi,

In my cold to frozen script I copy the bucket to another server. The second server is used to access the older entries for forensic investigation. The buckets are copied from cold on the main server to cold on the secondary server.

In order for Splunk to see the new buckets I need restart Splunk. Needless to say that this is less than optimal.

Is there a REST API command that I can issue that will instruct Splunkd on the secondary server to load the new bucket?

Thx

Joon

Tags (2)
0 Karma

Motivator

I have the same problem but only with hot buckets. It will be nice to find out if it possible to move hot buckets without restarting splunk.
I have been able to move cold or warm buckets form one server to another server where the index name is the same on both servers.

0 Karma

Motivator

It will be nice to find out it this is possible. I have the same problem.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!