How do i manually roll buckets in 4.1?

[Chris_R_]

How do i manually roll buckets in 4.1? The old method

./splunk search "| debug cmd=roll index=main"

does not work as expected, in fact it does not do anything....

[Chris_R_ · Accepted solution]

4.1 introduced new CLI commands, one of them is the "rolling buckets to warm" command.
Use

$SPLUNK_HOME/bin/splunk _internal call /data/indexes/main/roll-hot-buckets

Replace "main" For the index you wish to roll, and enter in admin level credentials. You should run this when Splunk is up and running.

[zliu]

/splunk/bin/splunk _internal call /data/indexes/main/roll-hot-buckets
/splunk/bin/splunk _internal call /data/indexes/access/roll-hot-buckets

[the_wolverine]

You can contact docs@splunk.com for any docs issues.

[Chris_R_]

Bunnyhop, expected results will be any hot_v_n(read/write) buckets you have in your index will be rolled into a warm db_n_n_n(read only)
Primary purpose of this is to prepare your system for backups.
Doc updates will be coming shortly as well.

[jrodman]

Awesome, I was trying to edit the debug processor to not emit errors on success. Would have been cool if anyone had told me it was being axed for 4.1 anyway.

[BunnyHop]

BTW, who in the org is in charge of documentation? I believe this process/procedure (debug cmd ...) is still in the 4.1 documentation for forcing bucket rolling.

[BunnyHop]

What's the expected result of this? It doesnt seem to perform the expected function.