Splunk Enterprise

Can cold buckets be rolled back to the homePath in a clustered deployment?


We've recently realized that we were rolling our buckets out the coldPath too soon - thereby not making full use of the homePath volume which uses directly-attached SSDs. I've increased maxWarmDBCount for most of the indexes and I'd now like to bring the buckets that have already been rolled out to cold back to the faster homePath.

I've reviewed https://answers.splunk.com/answers/208985/how-to-rollback-buckets-from-cold-to-warm.html but it reads like it's intended for a deployment that doesn't have clustered indexers.

Does anyone have a procedure that can be used in a clustered deployment?

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...