Splunk Search

Help with Query to list current status buckets

grivera_kudaw
Explorer

Hi.

Somebody to help me with a query to list current status buckets, example

Bucket Name Current Status
_internal~1321~D5156C32-9B6F Cannot Fix search count as the bucket hasn´t rolled yet

0 Karma

dkeck
Influencer

HI,

maybe this would help, will give you the state of buckets

| dbinspect index=*

or on master

| rest /services/cluster/master/buckets

0 Karma

dkeck
Influencer

If it helped please accept the answer 🙂

0 Karma

grivera_kudaw
Explorer

Hi.
Thank you.

I had already tried with those queries, but they do not show what I need to identify the bucket with the state "..hasn't rolled yet".

0 Karma
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...