Search Bucket ID Range

[ephemeric]

Greetz,

Is it possible to search a range of bucket ids?

I have moved a lot of warm/cold buckets and scrubbed the ids and would like to do this search to get an event count and compare to the count prior to moving the buckets on the old Splunk instance.

Thank you.

[sowings · Accepted solution]

Sort of. When you run a search, there's a field called _bkt that gets populated with the bucket's directory name. You'd first have to get the time endpoints for the search from the buckets themselves. The first 10-digit number in a bucket's directory name is the "latestTime" in epoch, and the second 10-digit number is the earliestTime epoch. Take the max and min of those respectively to determine your overall range for the range of buckets. Next, search over a custom time range (you should be able to enter an epoch time in the time picker), then rename _bkt to something without a leading (e.g. "bucket") , and then you should be able to stats count by bucket, or other search-y things like that.

[ephemeric]

Thank you.