Getting Data In

What is the difference between the dbinspect command and "_bkt"?

splunkreal
Motivator

Hello guys,

Could you let me know the difference in terms of buckets between :

| dbinspect *search* and *search* | eval bkt=_bkt | table bkt ?
It looks like dbinspect returns more results and with a wider span. My aim is to remove buckets according to a specific search and timeframe.

Thanks.

* If this helps, please upvote or accept solution 🙂 *
0 Karma
1 Solution

splunkreal
Motivator

Solved by support :

dbinspect take it data from the metadata
_bkt from from the search process.

the metadata can be update when we search but you
will search on your old generation id.

* If this helps, please upvote or accept solution 🙂 *

View solution in original post

0 Karma

splunkreal
Motivator

Solved by support :

dbinspect take it data from the metadata
_bkt from from the search process.

the metadata can be update when we search but you
will search on your old generation id.

* If this helps, please upvote or accept solution 🙂 *
0 Karma

gjanders
SplunkTrust
SplunkTrust

Can you accept your answer please? That will make this clear that you've answered your own question

splunkreal
Motivator

"We're sorry, but you cannot vote on your own post." 🙂

* If this helps, please upvote or accept solution 🙂 *
0 Karma

gjanders
SplunkTrust
SplunkTrust

Correct, but as per How to earn Karma you will get some points and you can up-vote anyone else's posts 🙂

0 Karma

gjanders
SplunkTrust
SplunkTrust

What are you trying to achieve by removing buckets?
You've also only posted a single search query mentioning dbinspect, dbinspect lists buckets on a per-index basis including replicated buckets.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...