Splunk Enterprise

How can we find out which index a frozen bucket belongs to?

gkas99
Explorer

Let's say we have bunch of frozen bucket files (db_<newest_time>_<oldest_time>_<localid>) on filesystem.

How do we we find out which indexes these frozen buckets belong to?

I looked into the files, some are text files which don't seem to have strings or fields that could tell which index it is.

Labels (2)
0 Karma

Gregski11
Contributor

I think we were able to get that info on our Cluster Master in the Web UI by going to Settings \ Distributed Environment \ Index Clustering

then click on Indexes and Bucket Status there you will see long string that makes up the Bucket Name 

 

then I think we ran the dbinspect command where bucketID = that

0 Karma

richgalloway
SplunkTrust
SplunkTrust

There is nothing in a bucket that says what index it belongs or belonged to.  Not that it matters.  Buckets can be in any index and still work.

When you thaw a bucket you put it into the thawed folder of an index.  If you don't know the original index then create a new one called, for example, thaweddata and put the buckets there.  Search the restored data using index=thaweddata.

To avoid this problem in the future. have your coldToFrozenScript write the frozen buckets in such a way that the index name is preserved, such as by creating a separate directory for each index.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...