Splunk Enterprise

How can we find out which index a frozen bucket belongs to?

gkas99
Explorer

Let's say we have bunch of frozen bucket files (db_<newest_time>_<oldest_time>_<localid>) on filesystem.

How do we we find out which indexes these frozen buckets belong to?

I looked into the files, some are text files which don't seem to have strings or fields that could tell which index it is.

Labels (2)
0 Karma

Gregski11
Contributor

I think we were able to get that info on our Cluster Master in the Web UI by going to Settings \ Distributed Environment \ Index Clustering

then click on Indexes and Bucket Status there you will see long string that makes up the Bucket Name 

 

then I think we ran the dbinspect command where bucketID = that

0 Karma

richgalloway
SplunkTrust
SplunkTrust

There is nothing in a bucket that says what index it belongs or belonged to.  Not that it matters.  Buckets can be in any index and still work.

When you thaw a bucket you put it into the thawed folder of an index.  If you don't know the original index then create a new one called, for example, thaweddata and put the buckets there.  Search the restored data using index=thaweddata.

To avoid this problem in the future. have your coldToFrozenScript write the frozen buckets in such a way that the index name is preserved, such as by creating a separate directory for each index.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...