Thanks, it is exactly what I need, it looks as link now, but it is probably ok. ... View more

It looks like solution for my concept. Unfortunately the first experiment shows a problem with reinserting of the repaired buckets to the original place. I simulate crash of Splunk with 'kill -9'. The Splunk check discovered these broken buckets: bucket=/opt/splunk/var/lib/splunk/audit/db/hot_v1_0 NEEDS REPAIR: count mismatch tsidx=388 source-metadata=248 bucket=/opt/splunk/var/lib/splunk/defaultdb/db/hot_v1_0 NEEDS REPAIR: count mismatch tsidx=315551 source-metadata=237012 I moved them out of the orig directory, then Splunk could start as expectd. I started rebuild for every bucket. Now everithing is ok, but how to reinsert it? There are some new events indexed during rebuild and now there are files with the same name in the original place. Diff on repair and new directory shows some conflicts. Is it safe to replace the new files with old ones? Is there some marge utility? Should I move only .tsidx files? Example of diff conflict, other file were unique in repair or original place: diff -r /opt/splunk/var/lib/splunk/audit/db/hot_v1_0/Hosts.data /opt/splunk/var/lib/splunk/audit/db/repair/hot_v1_0/Hosts.data 0 1 6 1319803955 1319803991 1319803991 1 host::myhost 6 1319803955 1319803991 1319803991 .--- 0 1 408 1319803860 1319803920 1319803920 1 host::myhost 408 1319803860 1319803920 1319803920 Binary files /opt/splunk/var/lib/splunk/audit/db/hot_v1_0/rawdata/slices.dat and /opt/splunk/var/lib/splunk/audit/db/repair/hot_v1_0/rawdata/slices.dat differ ... View more