Installation

Rebuild 4.1 Bucket in 4.2

ephemeric
Contributor

Greetz,

So I have tried:

./splunk _internal call /data/indexes/main/rebuild-metadata-and-manifests

in a 4.2.3 instance but a whole lot of XML goes flying by and nothing seems to happen.

Looking at index health I see many thawed buckets but with an event count of 0!

I did manage to rebuild the 4.2 buckets. This instance was upgraded from 4.7.1 hence the bucket mix.

Please help!!!

Tags (2)
0 Karma
1 Solution

ephemeric
Contributor

Me being stupid as usual.

This was not so clear to me.
You have to uncompress ALL of the *.gz files in the bucket and rawdata/.
I thought that if the bucket itself was compressed what this instruction was alluding to.

http://docs.splunk.com/Documentation/Splunk/latest/admin/Restorearchiveddata#Thaw_a_pre-4.2_archive

2. If the bucket was compressed when originally archived, uncompress the contents in the thawed directory.

View solution in original post

0 Karma

ephemeric
Contributor

Me being stupid as usual.

This was not so clear to me.
You have to uncompress ALL of the *.gz files in the bucket and rawdata/.
I thought that if the bucket itself was compressed what this instruction was alluding to.

http://docs.splunk.com/Documentation/Splunk/latest/admin/Restorearchiveddata#Thaw_a_pre-4.2_archive

2. If the bucket was compressed when originally archived, uncompress the contents in the thawed directory.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...