Splunk Search

Can real time remove/add the warm db?

lsmkelvin
New Member

Just for my interest.
Hope some one can answer my question and with thanks. ^^

Can i remove or add the warm database in real time without stop splunk process?

Thanks

Tags (3)
0 Karma

lukejadamec
Super Champion

Yes, but it might take a few minutes or so for Splunk to see the data.

Just make sure that the unique identifier of the bucket is unique to the folder.

0 Karma

lsmkelvin
New Member

Thanks for your quick response.

Another question, need to restart splunk process to take effect?

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!