Splunk Enterprise

How can we find out which index a frozen bucket belongs to?

gkas99
Explorer

Let's say we have bunch of frozen bucket files (db_<newest_time>_<oldest_time>_<localid>) on filesystem.

How do we we find out which indexes these frozen buckets belong to?

I looked into the files, some are text files which don't seem to have strings or fields that could tell which index it is.

Labels (2)
0 Karma

Gregski11
Contributor

I think we were able to get that info on our Cluster Master in the Web UI by going to Settings \ Distributed Environment \ Index Clustering

then click on Indexes and Bucket Status there you will see long string that makes up the Bucket Name 

 

then I think we ran the dbinspect command where bucketID = that

0 Karma

richgalloway
SplunkTrust
SplunkTrust

There is nothing in a bucket that says what index it belongs or belonged to.  Not that it matters.  Buckets can be in any index and still work.

When you thaw a bucket you put it into the thawed folder of an index.  If you don't know the original index then create a new one called, for example, thaweddata and put the buckets there.  Search the restored data using index=thaweddata.

To avoid this problem in the future. have your coldToFrozenScript write the frozen buckets in such a way that the index name is preserved, such as by creating a separate directory for each index.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...