#Splunk manual software#

The cluster-merge-buckets command includes support for clustered buckets using SmartStore. If there's an error during the cluster bucket merge process, the merge process is stopped, and the pre-merged buckets are marked searchable again. After the group of buckets are merged, the newly created bucket is marked as searchable, and the old buckets are removed. The command is used to select and merge a group of buckets in a specific index, based on a time range and size limits. Also you can use it to check for journal integrity prior to issuing a rebuild, if you wish to know whether the rebuild can complete successfully before running it.Ĭomplementary but nonoverlapping with the splunk fsck command This tool can be useful if you are worried or believe there may be data integrity problems in a set of buckets or index.

#Splunk manual software#

'rawdata' is the record of truth from which Splunk software can rebuild the other components of a bucket. Unpacks and verifies the 'rawdata' component one or more buckets. The 'splunk train sourcetype' CLI command calls classify. btprobe -compute-crc /var/log/inputfile -salt SOME_SALT classify Query a specified BTree for a given key or file.įrom the Splunk software installation directory, type: You must specify either -d or -compute-crc. Shut down your Splunk software before using btprobe. Any changes made to the fishbucket using btprobe take effect only after a restart. Queries the fishbucket for checkpoints stored by monitor inputs. splunk btool -app= app_name -user= user_name conf_file_prefix delete stanza_name įor more examples, see Use btool to troubleshoot configurations. debug Print and log extra debugging information dir=DIR Read configuration data from the given absolute path instead of $SPLUNK_HOME/etc app=SPLUNK_APP View the configuration data visible from the given app user=SPLUNK_USER View the configuration data visible to the given user