Why has my cold-to-frozen export script stopped working?

[Lowell]

I just noticed that my coldToFrozenScript stopped working around about 4.1.4 and all my exports have been failing. The export bucket location does contains no data.

I did some followup testing and tried to run exporttool by hand, and I'm seeing the following message for all my buckets:

no events

My script is based on the flatfileExport.sh.example script provided by splunk.

Any ideas?

[Lowell · Accepted solution]

Check to see if your usage of the exportool utility includes meta::all. If it does, remove it. Splunk has apparently deprecated this command line argument.

---

In the example of the flatfileExport.sh.example, you should change this line:

exporttool "$1" "${1}/index.export" meta::all

should now be:

exporttool "$1" "${1}/index.export"

---

I have requested that splunk add this to their release changelog.

[Stephen_Sorkin]

Lowell, sorry about this oversight. We have fixed exporttool to restore backwards compatibility for calling arguments. This will ship in 4.1.5.