I am trying to roll hot bucket using following cmd, and it it throwing error ,with http status=503,
Please tell me, where I am doing mistake:
C:\Program Files\Splunk\bin>splunk _internal call /data/indexes/olym/roll-hot-buckets -auth admin:changeme
QUERYING: 'https://127.0.0.1:8089/services/data/indexes/olym/roll-hot-buckets'
FAILED: 'HTTP/1.1 503 Service Unavailable'
Content:
<msg type="ERROR">
In handler 'indexes': could not queue custom action='roll-hot-buckets' for idx=olym
I had a similar issue. I found out that I had actually run out of disk space on the RAID where my indexes were stored. That may be something to look into.
Which version of Splunk you are using?
I am using Splunk 6.2.0 (build 237341)
Hi Michael,
Splunk is running and working fine. I am not able to get relevant logs in splunkd.
PS: I am searching the logs in C:\ Program Files\ Splunk\ var\ log\ splunk\ splunkd location. Correct me if I am wrong.
Thanks,
Rajul
Okay, may I ask why you want to do this? If you do it because you want to backup see the docs http://docs.splunk.com/Documentation/Splunk/6.2.1/Indexer/Backupindexeddata and most important this part of it:
Important: It is ordinarily not advisable to roll hot buckets manually, as each forced roll permanently decreases search performance over the data. As a general rule, larger buckets are more efficient to search. By prematurely rolling buckets, you're producing smaller, less efficient buckets. In cases where hot data needs to be backed up, a snapshot backup is the preferred method.
What happens if you try to roll the _internal
index like this:
splunk _internal call /data/indexes/_internal/roll-hot-buckets -auth admin:changeme
Hi Michael,
I want to do this for R & D purpose. It is my home lab not the critical servers.
I tried it for the index "_internal", it is throwing the same error:
C:\Program Files\Splunk\bin>splunk _internal call /data/indexes/_internal/roll-h
ot-buckets -auth admin:changeme
QUERYING: 'https://127.0.0.1:8089/services/data/indexes/_internal/roll-hot-bucke
ts'
FAILED: 'HTTP/1.1 503 Service Unavailable'
Content:
<msg type="ERROR">
In handler 'indexes': could not queue custom action='roll-hot-buckets' for idx=
_internal
Regards,
Rajul
Is your Splunk running and working? run splunk status
also check splunkd.log