Splunk Search

What is the syntax for rolling hot buckets to warm via cli?

the_wolverine
Champion

What is the syntax, please?

1 Solution

the_wolverine
Champion

From the CLI:

./splunk _internal call /data/indexes/<index_name>/roll-hot-buckets –auth <admin_username>

(you will be prompted for the password)

View solution in original post

0 Karma

the_wolverine
Champion

From the CLI:

./splunk _internal call /data/indexes/<index_name>/roll-hot-buckets –auth <admin_username>

(you will be prompted for the password)

0 Karma

hanijamal
New Member

what is the command or procedure to roll buckets on windows?

0 Karma

wrangler2x
Motivator

If you do this when you have splund off it does not work. If you do this when it is running, though it creates a new cold bucket you still have a hot one. If you are trying to move the index, how do you do that when the documentation says not to copy hot buckets?

0 Karma

joxley
Path Finder
0 Karma

wwhitener
Communicator

This is for 4.x.

For 3.4.5 it is:

/opt/splunk/bin/splunk search '| oldsearch !++cmd++::roll' -auth :

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...