Hi all,
I'm checking out the "merge-buckets" command. I created an index with 1000 events per bucket. in sum my index have
~/splunk/bin/splunk search "| dbinspect index=testbuckets2 | stats count"
count
-----
5479
buckets.
~/splunk/bin/splunk merge-buckets --index-name=testbuckets2 --min-size=1 --max-count=1000
Using the following config: --max-count=1000 --min-size=1 --max-size=1000 --max-timespan=7776000
Found (300) buckets to merge.
Starting to merge (300) buckets. Number of buckets already merged: 0/300 (0.00%).
New Bucket:
/Users/andreas/splunk/var/lib/splunk/testbuckets2/db/db_1653310364_1653310268_17359
Number of buckets merged: 300/300 (100.00%).
Number of buckets created: 1.
Time taken: 27 seconds, 21 milliseconds
after the operation i see 299 buckets less
~/splunk/bin/splunk search "| dbinspect index=testbuckets2 | stats count"
count
-----
5180
running merge-bucket a second time doesn't merge any further buckets. It seems there is a hardcoded limit of 300 buckets?! any good reason for this?
best regards,
Andreas
