Rebuild 4.1 Bucket in 4.2



So I have tried:

./splunk _internal call /data/indexes/main/rebuild-metadata-and-manifests

in a 4.2.3 instance but a whole lot of XML goes flying by and nothing seems to happen.

Looking at index health I see many thawed buckets but with an event count of 0!

I did manage to rebuild the 4.2 buckets. This instance was upgraded from 4.7.1 hence the bucket mix.

Please help!!!

Tags (2)
0 Karma

Re: Rebuild 4.1 Bucket in 4.2


Me being stupid as usual.

This was not so clear to me.
You have to uncompress ALL of the *.gz files in the bucket and rawdata/.
I thought that if the bucket itself was compressed what this instruction was alluding to.

2. If the bucket was compressed when originally archived, uncompress the contents in the thawed directory.

View solution in original post

0 Karma