as described in the docs, the command for rolling buckets manually from hot to warm is
./splunk _internal call /data/indexes/<index_name>/roll-hot-buckets –auth <admin_username>:<admin_password>
as described in the docs, the command for rolling buckets manually from hot to warm is
./splunk _internal call /data/indexes/<index_name>/roll-hot-buckets –auth <admin_username>:<admin_password>
The _internal call is just a manual way to hit the roll endpoint, so it should work until we maybe someday change the REST interface to request this, or change the '_internal' command somehow (more likely). You could achieve the same thing with wget.
bucket-maint was added as a friendlier interface, a real command.
Confirmed, this 4.1.x command does work as expected in 4.2.
Okay, I'll go with the 4.1.x method for now. Bucket-maint is mentioned by Josh here: http://answers.splunk.com/questions/2473/
we'll look into the bucket-maint command you heard about, though 🙂