Splunk Search

What is the syntax for rolling hot buckets to warm via cli?

the_wolverine
Champion

What is the syntax, please?

1 Solution

the_wolverine
Champion

From the CLI:

./splunk _internal call /data/indexes/<index_name>/roll-hot-buckets –auth <admin_username>

(you will be prompted for the password)

View solution in original post

0 Karma

the_wolverine
Champion

From the CLI:

./splunk _internal call /data/indexes/<index_name>/roll-hot-buckets –auth <admin_username>

(you will be prompted for the password)

0 Karma

hanijamal
New Member

what is the command or procedure to roll buckets on windows?

0 Karma

wrangler2x
Motivator

If you do this when you have splund off it does not work. If you do this when it is running, though it creates a new cold bucket you still have a hot one. If you are trying to move the index, how do you do that when the documentation says not to copy hot buckets?

0 Karma

joxley
Path Finder
0 Karma

wwhitener
Communicator

This is for 4.x.

For 3.4.5 it is:

/opt/splunk/bin/splunk search '| oldsearch !++cmd++::roll' -auth :

0 Karma
Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Building Momentum: Splunk Developer Program at .conf25

At Splunk, developers are at the heart of innovation. That’s why this year at .conf25, we officially launched ...