I'm looking to move some buckets around (as a test for now) and I found this link:
https://docs.splunk.com/Documentation/Splunk/8.0.5/Troubleshooting/CommandlinetoolsforusewithSupport
The locktool seemed like something useful to my scenario as the description reads "If you were to write an external script to copy db buckets in and out of indexes you should acquire locks on the db colddb and thaweddb directories as you are modifying them and release the locks when you are done.".
I tried to integrate it into my workflow, however, I'm not seeing the expected behaviour with it. Despite the lock being in place for db path, I found that sometimes during my copy operation the tsidx files get changed inside the buckets. I tried locking at various levels (db path, each bucket individually, just tsidx files or a combination of the 3) but I still see this behaviour every now and then.
I was hoping to achieve this operation without bringing the splunkd service down on my peer nodes.
Is there something I'm missing here?
I would really appreciate some insight into this.
