How can you add/move a bucket without restarting splunkd?

How do you get splunk to recognize new buckets without restarting splunkd? This makes the process of restoring or moving buckets between indexed more time consuming.

If I remember correctly, this was possible in Splunk 3.4.x by simply copying a bucket into the db or thaweddb folder (as long as you used an atomic move operation), but Splunk 4.0 doesn't seem to automatically detect new buckets the same way. (I noticed that dbinspect seems to see changes immediately, but searches do not.)

asked 23 Mar '10, 18:33

Lowell ♦
9.6k●6●37
accept rate: 40%

edited 24 Mar '10, 14:33

gkanapathy ♦
26.5k●1●6●22

One Answer:

oldest newest most voted

Rough first take:

In the <indexname>/db directory, delete the file .bucketmanifest
In the <indexname>/db directory, create the file (0 bytes works) meta.dirty

If we get into goat sacrifice territory, try also deleting .metamanifest. Step 2 should render that unnecessary. These files and their associated data should get rebuilt on need by search activity.

link

answered 23 Mar '10, 23:32

jrodman ♦
5.8k●2●5●15
accept rate: 42%

Thanks! That worked.

I noticed that .bucketManifest was not recreated automatically, and the the bucket was not added in .metaManifest. When do these get updated?

(24 Mar '10, 14:12) Lowell ♦

Post your answer

toggle preview

Follow this question

Email:

RSS:

Answers

Answers + Comments

Markdown Basics

*italic* or _italic_
**bold** or __bold__
link:[text](http://url.com/ "Title")
image?![alt text](/path/img.jpg "Title")
numbered list: 1. Foo 2. Bar
to add a line break simply add two spaces to where you would like the new line to be.
basic HTML tags are also supported

learn more about Markdown

Tags:

index ×300
buckets ×63

Asked: 23 Mar '10, 18:33

Seen: 650 times

Last updated: 24 Mar '10, 14:33

How can you add/move a bucket without restarting splunkd?

Follow this question

Splunk Resources

Related questions