Skip to content

Instantly share code, notes, and snippets.

@bcc bcc/Fix-SplunkBuckets.ps1
Last active Mar 11, 2019

What would you like to do?
Fix splunk bucket ID clashes
# Used this to merge buckets from a cluster that was being deprecated into a single node for archive purposes.
# You can leave the node GUID, but the IDs do need to be unique. It's not pretty but it works.
# 0. Stop splunk
# 1. Copy {index}/db/db_* directories from each indexer (you can ignore the rb_ ones, those are replicated buckets). On windows, this works well over RDP: robocopy "\\tsclient\D\Splunk\var\lib\splunk" f:\indexes /MIR /XD "rb_*" /XD "hot_*" /XD "GlobalMetaData"
# 2. Add missing indexes to etc/system/local/indexes.conf
# 3. Run this script in the db directory for any index with conflicting bucket IDs (probably all of them that you've messed with)
# 4. If the internal indexes are fine and splunk starts (if not, check splunkd.log), check the index list for any other disabled indexes and enable them. This search will find any further conflicts: index="_internal" "id conflicts"
# 5. You might also need to handle colddb - easiest thing is to bump $id to a safe value (greater than number of buckets in db) and rerun.
$dirs = get-childitem |sort-object -Property name | where {$_.Name -match '^db_' }
$id = 0
$indexers = @{}
$dirs | % {
$components = $_.Name -split '_'
foreach ($indexer in $indexers.Keys) {
$dirs | % {
$components = $_.Name -split '_'
if ($components[4] -eq $indexer) {
$from = $components -join '_'
$components[3] = $id
$to = $components -join '_'
rename-item -Path $from -newname $to
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.