Check and Repair Metadata
From Splunk Wiki
Official Doc for fsck command tool http://docs.splunk.com/Documentation/Splunk/Latest/Troubleshooting/CommandlinetoolsforusewithSupport#fsck
From Splunk 4.2.1, fsck utility is available to check and repair metadata files.
The syntax of fsck command is as follows:
USAGE: splunkd fsck [--hots] include hot buckets in scan [--warms] include warm buckets in scan [--colds] include cold buckets in scan [--thawed] include thawed buckets in scan [--all] include all types of buckets [--index <index>] only scan specified index (defaults to all) [--quiet] silence info output (will still output errors) [--repair] attempt to repair buckets if errors found
E.g., to check metadata, run the following command from the $SPLUNK_HOME/bin directory:
./splunk cmd splunkd fsck --all --mode metadata
The results will be displayed on the console window.
If any problem is reported at the above step, you can run fsck with --repair option, i.e.,
./splunk stop ./splunk cmd splunkd fsck --all --mode metadata --repair
Note, you may directly run this fsck repair command. The fsck utility will always check the data first, if no corruption, no repairing will be performed.
If corruption is detected by the fsck utility, you may run 'rebuild' command to repair it instead of using the 'fsck' command, e.g.,:
./splunk stop ./splunk rebuild /Users/xli/install/splunk4.2.1/var/lib/splunk/defaultdb/db
where the argument is the path to the bucket that corruption is detected.
Does fsck correctly detect if it is safe to modify data, or does it just check if splunkd is running? Or does it leave the problem totally up to the administrator?