Knowledge Management

Splunk locktool is not working as per documentation

iarora
New Member

I'm looking to move some buckets around (as a test for now) and I found this link:

https://docs.splunk.com/Documentation/Splunk/8.0.5/Troubleshooting/CommandlinetoolsforusewithSupport

The locktool seemed like something useful to my scenario as the description reads "If you were to write an external script to copy db buckets in and out of indexes you should acquire locks on the db colddb and thaweddb directories as you are modifying them and release the locks when you are done.".

I tried to integrate it into my workflow, however, I'm not seeing the expected behaviour with it. Despite the lock being in place for db path, I found that sometimes during my copy operation the tsidx files get changed inside the buckets. I tried locking at various levels (db path, each bucket individually, just tsidx files or a combination of the 3) but I still see this behaviour every now and then.

I was hoping to achieve this operation without bringing the splunkd service down on my peer nodes.

Is there something I'm missing here?
I would really appreciate some insight into this.

Labels (2)
Tags (4)
0 Karma
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...