Splunk Search

What is the syntax for rolling hot buckets to warm via cli?

Champion

What is the syntax, please?

1 Solution

Champion

From the CLI:

./splunk _internal call /data/indexes/<index_name>/roll-hot-buckets –auth <admin_username>

(you will be prompted for the password)

View solution in original post

0 Karma

Champion

From the CLI:

./splunk _internal call /data/indexes/<index_name>/roll-hot-buckets –auth <admin_username>

(you will be prompted for the password)

View solution in original post

0 Karma

New Member

what is the command or procedure to roll buckets on windows?

0 Karma

Motivator

If you do this when you have splund off it does not work. If you do this when it is running, though it creates a new cold bucket you still have a hot one. If you are trying to move the index, how do you do that when the documentation says not to copy hot buckets?

0 Karma

Path Finder
0 Karma

Communicator

This is for 4.x.

For 3.4.5 it is:

/opt/splunk/bin/splunk search '| oldsearch !++cmd++::roll' -auth :

0 Karma