Splunk Enterprise

How can we find out which index a frozen bucket belongs to?

gkas99
Explorer

Let's say we have bunch of frozen bucket files (db_<newest_time>_<oldest_time>_<localid>) on filesystem.

How do we we find out which indexes these frozen buckets belong to?

I looked into the files, some are text files which don't seem to have strings or fields that could tell which index it is.

Labels (2)
0 Karma

Gregski11
Contributor

I think we were able to get that info on our Cluster Master in the Web UI by going to Settings \ Distributed Environment \ Index Clustering

then click on Indexes and Bucket Status there you will see long string that makes up the Bucket Name 

 

then I think we ran the dbinspect command where bucketID = that

0 Karma

richgalloway
SplunkTrust
SplunkTrust

There is nothing in a bucket that says what index it belongs or belonged to.  Not that it matters.  Buckets can be in any index and still work.

When you thaw a bucket you put it into the thawed folder of an index.  If you don't know the original index then create a new one called, for example, thaweddata and put the buckets there.  Search the restored data using index=thaweddata.

To avoid this problem in the future. have your coldToFrozenScript write the frozen buckets in such a way that the index name is preserved, such as by creating a separate directory for each index.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Splunk Enterprise Security 8.0.2 Availability: On cloud and On-premise!

A few months ago, we released Splunk Enterprise Security 8.0 for our cloud customers. Today, we are excited to ...

Logs to Metrics

Logs and Metrics Logs are generally unstructured text or structured events emitted by applications and written ...

Developer Spotlight with Paul Stout

Welcome to our very first developer spotlight release series where we'll feature some awesome Splunk ...