Hi All,
Recently I have my splunk hot drive got corrupted so I symlink my hot directory to new working drive. I get all my new data written to new one but whenever a bucket gets rolled from hot , nothing is getting written to warm db(as if no new new buckets are getting created). But i can still see the data in splunk.
Any idea what is happening here and with this procedure of symlink do I lost some old data.
↧