Thanks for replying. I had been running splunk 8.2 with it working fine and then upgraded to 9.0.3 on CentOS 7. I'm pretty sure 9.0.3 had been working fine as well, but I may be mistaken on the timing. I did have to do a server name change on the indexers, but the frozen server stayed the same. My indexers write to a frozen server over NFS and nfs exports uses ip address, not name. My coldtofrozen.py script hasn't changed, but when I run it this is what I get. [bin]# ./splunk cmd "/opt/splunk/bin/python" "/opt/splunk/etc/peer-apps/archive_app/coldToFrozen.py" usage: python coldToFrozenExample.py <bucket_dir_to_archive> [bin]# Full script, edited to remove comments and internal server names. #!/opt/splunk/bin python import sys, os, gzip, shutil, subprocess, random, socket hname = socket.gethostname() ARCHIVE_DIR = os.path.join('/mnt/nfs/frozensrv', hname) def handleNewBucket(base, files): print('Archiving bucket: ' + base) for f in files: full = os.path.join(base, f) if os.path.isfile(full): os.remove(full) if __name__ == "__main__": if len(sys.argv) != 2: sys.exit('usage: python coldToFrozenExample.py <bucket_dir_to_archive>') if not os.path.isdir(ARCHIVE_DIR): try: os.mkdir(ARCHIVE_DIR) except OSError: # Ignore already exists errors, another concurrent invokation may have already created this dir sys.stderr.write("mkdir warning: Directory '" + ARCHIVE_DIR + "' already exists\n") bucket = sys.argv[1] if not os.path.isdir(bucket): sys.exit('Given bucket is not a valid directory: ' + bucket) rawdatadir = os.path.join(bucket, 'rawdata') if not os.path.isdir(rawdatadir): sys.exit('No rawdata directory, given bucket is likely invalid: ' + bucket) files = os.listdir(bucket) journal = os.path.join(rawdatadir, 'journal.gz') if os.path.isfile(journal): handleNewBucket(bucket, files) else: handleOldBucket(bucket, files) if bucket.endswith('/'): bucket = bucket[:-1] indexname = os.path.basename(os.path.dirname(os.path.dirname(bucket))) destdir = os.path.join(ARCHIVE_DIR, indexname, os.path.basename(bucket)) while os.path.isdir(destdir): print('Warning: This bucket already exists in the archive directory') print('Adding a random extension to this directory...') destdir += '.' + str(random.randrange(10)) shutil.copytree(bucket, destdir)
... View more