Splunk Enterprise

How can we find out which index a frozen bucket belongs to?

gkas99
Explorer

Let's say we have bunch of frozen bucket files (db_<newest_time>_<oldest_time>_<localid>) on filesystem.

How do we we find out which indexes these frozen buckets belong to?

I looked into the files, some are text files which don't seem to have strings or fields that could tell which index it is.

Labels (2)
0 Karma

Gregski11
Contributor

I think we were able to get that info on our Cluster Master in the Web UI by going to Settings \ Distributed Environment \ Index Clustering

then click on Indexes and Bucket Status there you will see long string that makes up the Bucket Name 

 

then I think we ran the dbinspect command where bucketID = that

0 Karma

richgalloway
SplunkTrust
SplunkTrust

There is nothing in a bucket that says what index it belongs or belonged to.  Not that it matters.  Buckets can be in any index and still work.

When you thaw a bucket you put it into the thawed folder of an index.  If you don't know the original index then create a new one called, for example, thaweddata and put the buckets there.  Search the restored data using index=thaweddata.

To avoid this problem in the future. have your coldToFrozenScript write the frozen buckets in such a way that the index name is preserved, such as by creating a separate directory for each index.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Shape the Future of Splunk: Join the Product Research Lab!

Join the Splunk Product Research Lab and connect with us in the Slack channel #product-research-lab to get ...