4.1 introduced new CLI commands, one of them is the "rolling buckets to warm" command.
Use
$SPLUNK_HOME/bin/splunk _internal call /data/indexes/main/roll-hot-buckets
Replace "main" For the index you wish to roll, and enter in admin level credentials. You should run this when Splunk is up and running.
4.1 introduced new CLI commands, one of them is the "rolling buckets to warm" command.
Use
$SPLUNK_HOME/bin/splunk _internal call /data/indexes/main/roll-hot-buckets
Replace "main" For the index you wish to roll, and enter in admin level credentials. You should run this when Splunk is up and running.
/splunk/bin/splunk _internal call /data/indexes/main/roll-hot-buckets
/splunk/bin/splunk _internal call /data/indexes/access/roll-hot-buckets
You can contact docs@splunk.com for any docs issues.
Bunnyhop, expected results will be any hot_v_n(read/write) buckets you have in your index will be rolled into a warm db_n_n_n(read only)
Primary purpose of this is to prepare your system for backups.
Doc updates will be coming shortly as well.
Awesome, I was trying to edit the debug processor to not emit errors on success. Would have been cool if anyone had told me it was being axed for 4.1 anyway.
BTW, who in the org is in charge of documentation? I believe this process/procedure (debug cmd ...) is still in the 4.1 documentation for forcing bucket rolling.
What's the expected result of this? It doesnt seem to perform the expected function.