There is a command which can roll an index from hot to warm -
splunk _internal call /data/indexes//roll-hot-buckets –auth (admin_username):(admin_password)
Is there a way we can roll all the index instead of rolling one by one?
↧