Installation

_thefishbucket empty

Branden
Builder

Hi. We are migrating our Splunk instance to a new server. We do not want it to re-index a directory that we have as a monitor. It was recommended that I copy over our fishbucket.

I'm looking in /opt/splunk/var/lib/splunk and I see _thefishbucket.dat, but it's empty.

How can I prevent a re-index if my fishbucket is empty?

Thanks!

Labels (1)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

There should be a directory fishbucket, it's not the .dat file.

0 Karma

ddrillic
Ultra Champion

@Branden, are you looking at the _thefishbucket on the forwarder?

0 Karma
Get Updates on the Splunk Community!

Upcoming Community Maintenance: 10/28

Howdy folks, just popping in to let you know that the Splunk Community site will be in read-only mode ...

Best Practices for Metrics Pipeline Management

We can’t guarantee the health of our services or a great user experience without data from our applications. ...

New Case Study: How LSU’s Student-Powered SOCs and Splunk Are Shaping the Future of ...

Louisiana State University (LSU) is shaping the next generation of cybersecurity professionals through its ...