All Apps and Add-ons

"Merging hot Databases"

theshyster
New Member

I was intending to moving my colddb and thaweddb indexes over and I mixed up the parent folder.
So I ended up moving the folder with all my hot db, while the splunk service was still running.

When I had realized my folly, I decided to move the hot db in their original location, but the service had already recreated db folder and certain config files:
I decided to merge the db folders together, but certain files I chose to not overwrite
Hosts.data
Sources.data
SourceTypes.data
.bucketManifest
.metaManifest
But I fear that certain hot db files may longer be referenced in the newly created config files.

The entire splunk index is striped across 3 indexes so I'm not sure if automatically repairs inconsistencies in the indexes. How can I check if I successfully merged the 2 "hot" db folders back together?

Tags (2)
0 Karma
1 Solution

jbsplunk
Splunk Employee
Splunk Employee

So long as you don't have bucket id conflicts, you should be able to restart splunk and if you're on a version above 4.2, the hot buckets would be rolled to warm. *.data files would be rebuilt when that happens and you can check the .data files for the number of events, earliest, latest, and actual latest event times. You can then search that time range and if you don't end up with a number smaller than this(it could be larger because of time range overlap in buckets), I'd think you should be ok.

View solution in original post

jbsplunk
Splunk Employee
Splunk Employee

So long as you don't have bucket id conflicts, you should be able to restart splunk and if you're on a version above 4.2, the hot buckets would be rolled to warm. *.data files would be rebuilt when that happens and you can check the .data files for the number of events, earliest, latest, and actual latest event times. You can then search that time range and if you don't end up with a number smaller than this(it could be larger because of time range overlap in buckets), I'd think you should be ok.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...