Modifier and Type | Method and Description |
---|---|
Socket |
attach()
Creates a writable socket to this index.
|
Socket |
attach(Args args)
Creates a writable socket to this index.
|
void |
attachWith(ReceiverBehavior behavior)
Writes events to this index, reusing the connection.
|
Index |
clean(int maxSeconds)
Cleans this index, which removes all events from it.
|
boolean |
getAssureUTF8()
Indicates whether the data retrieved from this index has been
UTF8-encoded.
|
int |
getBloomfilterTotalSizeKB()
Returns the total size of all bloom filter files.
|
String |
getBucketRebuildMemoryHint()
Returns the suggested size of the .tsidx file for the bucket rebuild
process.
|
String |
getColdPath()
Returns the absolute file path to the cold database for this index.
|
String |
getColdPathExpanded()
Returns the expanded absolute file path to the cold database for this
index.
|
String |
getColdToFrozenDir()
Returns the frozen archive destination path for this index.
|
String |
getColdToFrozenScript()
Returns the path to the archiving script.
|
boolean |
getCompressRawdata()
Deprecated.
Splunk always compresses raw data.
|
int |
getCurrentDBSizeMB()
Returns the current size of this index.
|
String |
getDefaultDatabase()
Return the default index name of the Splunk instance.
|
boolean |
getEnableOnlineBucketRepair()
Returns whether asynchronous "online fsck" bucket repair is enabled.
|
boolean |
getEnableRealtimeSearch()
Indicates whether real-time search is enabled for this index.
|
int |
getFrozenTimePeriodInSecs()
Returns the maximum age for a bucket, after which the data in this index
rolls to frozen.
|
String |
getHomePath()
Returns the absolute path to both hot and warm buckets for this index.
|
String |
getHomePathExpanded()
Returns the expanded absolute path to both hot and warm buckets for this
index.
|
String |
getIndexThreads()
Returns the index thread for this index.
|
String |
getLastInitTime()
Returns the last initialization time for this index.
|
String |
getMaxBloomBackfillBucketAge()
Returns the time that indicates a bucket age.
|
int |
getMaxConcurrentOptimizes()
Returns the maximum number of concurrent optimize processes that
can run against a hot bucket for this index.
|
String |
getMaxDataSize()
Returns the maximum data size before triggering a roll from hot to warm
buckets for this index.
|
String |
getMaxHotBuckets()
Returns the maximum number of hot buckets that can exist for this index.
|
int |
getMaxHotIdleSecs()
Returns the maximum lifetime of a hot bucket for this index.
|
int |
getMaxHotSpanSecs()
Returns the upper bound of the target maximum timespan of
hot and warm buckets for this index.
|
int |
getMaxMemMB()
Returns the amount of memory to allocate for buffering
a single .tsidx file into memory before flushing to disk.
|
int |
getMaxMetaEntries()
Returns the maximum number of unique lines that are allowed
in a bucket's .data files for this index.
|
int |
getMaxRunningProcessGroups()
Returns the maximum number of concurrent helper processes for this index.
|
Date |
getMaxTime()
Returns the maximum time attribute for this index.
|
int |
getMaxTimeUnreplicatedNoAcks()
Returns the upper limit, in seconds, for how long an event can sit in a
raw slice.
|
int |
getMaxTimeUnreplicatedWithAcks()
Returns the upper limit, in seconds, for how long an event can sit
unacknowledged in a raw slice.
|
int |
getMaxTotalDataSizeMB()
Returns the maximum size of this index.
|
int |
getMaxWarmDBCount()
Returns the maximum number of warm buckets for this index.
|
String |
getMemPoolMB()
Returns the memory pool for this index.
|
String |
getMinRawFileSyncSecs()
Returns the frequency at which Splunkd forces a filesystem sync while
compressing journal slices for this index.
|
Date |
getMinTime()
Returns the minimum time attribute for this index.
|
int |
getNumBloomfilters()
Returns the number of bloom filters created for this index.
|
int |
getNumHotBuckets()
Returns the number of hot buckets that were created for this index.
|
int |
getNumWarmBuckets()
Returns the number of warm buckets created for this index.
|
int |
getPartialServiceMetaPeriod()
Returns the frequency at which metadata is for partially synced (synced
in-place) for this index.
|
int |
getQuarantineFutureSecs()
Returns the future event-time quarantine for this index.
|
int |
getQuarantinePastSecs()
Returns the past event-time quarantine for this index.
|
int |
getRawChunkSizeBytes()
Returns the target uncompressed size of individual raw slices in the
rawdata journal for this index.
|
int |
getRotatePeriodInSecs()
Returns the frequency to check for the need to create a new hot bucket
and the need to roll or freeze any warm or cold buckets for this index.
|
int |
getServiceMetaPeriod()
Returns the frequency at which metadata is synced to disk for this index.
|
String |
getSuppressBannerList()
Returns a list of indexes that suppress "index missing" messages.
|
int |
getSync()
Returns the number of events that trigger the indexer to sync events.
|
boolean |
getSyncMeta()
Indicates whether the sync operation is called before the file
descriptor is closed on metadata updates.
|
String |
getThawedPath()
Returns the absolute path to the thawed index for this index.
|
String |
getThawedPathExpanded()
Returns the expanded absolute path to the thawed index for this index.
|
int |
getThrottleCheckPeriod()
Returns the frequency at which Splunk checks for an index throttling
condition.
|
int |
getTotalEventCount()
Returns the total event count for this index.
|
boolean |
isInternal()
Indicates whether this index is an internal index.
|
void |
rollHotBuckets()
Performs rolling hot buckets for this index.
|
void |
setAssureUTF8(boolean assure)
Sets whether the data retrieved from this index is UTF8-encoded.
|
void |
setBlockSignSize(int value)
Sets the number of events that make up a block for block signatures.
|
void |
setBucketRebuildMemoryHint(String value)
Sets the suggested size of the .tsidx file for the bucket rebuild
process.
|
void |
setColdToFrozenDir(String destination)
Sets the destination path for the frozen archive, where Splunk
automatically puts frozen buckets.
|
void |
setColdToFrozenScript(String script)
Sets the path to the archiving script.
|
void |
setEnableOnlineBucketRepair(boolean value)
Sets whether asynchronous "online fsck" bucket repair is enabled.
|
void |
setFrozenTimePeriodInSecs(int seconds)
Sets the maximum age for a bucket, after which the data in this index
rolls to frozen.
|
void |
setMaxBloomBackfillBucketAge(String time)
Sets the time that indicates a bucket age.
|
void |
setMaxConcurrentOptimizes(int processes)
Sets the number of concurrent optimize processes that can run against
a hot bucket for this index.
|
void |
setMaxDataSize(String size)
Sets the maximum data size before triggering a roll from hot to warm
buckets for this index.
|
void |
setMaxHotBuckets(String size)
Sets the maximum number of hot buckets that can exist per index.
|
void |
setMaxHotIdleSecs(int seconds)
Sets the maximum lifetime of a hot bucket for this index.
|
void |
setMaxHotSpanSecs(int seconds)
Sets the upper bound of the target maximum timespan of hot and warm
buckets for this index.
|
void |
setMaxMemMB(int memory)
Sets the amount of memory allocated for buffering a single .tsidx
file before flushing to disk.
|
void |
setMaxMetaEntries(int entries)
Sets the maximum number of unique lines in .data files in a bucket, which
may help to reduce memory consumption.
|
void |
setMaxTimeUnreplicatedNoAcks(int value)
Sets the upper limit for how long an event can sit in a
raw slice.
|
void |
setMaxTimeUnreplicatedWithAcks(int value)
Sets the upper limit for how long an event can sit unacknowledged in a
raw slice.
|
void |
setMaxTotalDataSizeMB(int size)
Sets the maximum size for this index.
|
void |
setMaxWarmDBCount(int buckets)
Sets the maximum number of warm buckets.
|
void |
setMinRawFileSyncSecs(String frequency)
Sets the frequency at which Splunkd forces a file system sync while
compressing journal slices for this index.
|
void |
setPartialServiceMetaPeriod(int frequency)
Sets the frequency at which metadata is for partially synced (synced
in-place) for this index.
|
void |
setQuarantineFutureSecs(int window)
Sets a quarantine for events that are timestamped in the future to help
prevent main hot buckets from being polluted with fringe events.
|
void |
setQuarantinePastSecs(int window)
Sets a quarantine for events that are timestamped in the past to help
prevent main hot buckets from being polluted with fringe events.
|
void |
setRawChunkSizeBytes(int size)
Sets the target uncompressed size of individual raw slices in the rawdata
journal for this index.
|
void |
setRotatePeriodInSecs(int frequency)
Sets the frequency to check for the need to create a new hot bucket and
the need to roll or freeze any warm or cold buckets for this index.
|
void |
setServiceMetaPeriod(int frequency)
Sets the frequency at which metadata is synced to disk for this index.
|
void |
setSyncMeta(boolean sync)
Sets whether the sync operation is called before the file descriptor is
closed on metadata updates.
|
void |
setThrottleCheckPeriod(int frequency)
Sets the frequency at which Splunk checks for an index throttling
condition.
|
void |
submit(Args args,
String data)
Submits an event to this index through an HTTP POST request.
|
void |
submit(String data)
Submits an event to this index through an HTTP POST request.
|
void |
upload(String filename)
Uploads a file to this index as an event stream.
|
void |
upload(String filename,
Args args)
Uploads a file to this index as an event stream.
|
actionPath, clear, containsKey, containsValue, disable, enable, entrySet, get, getContent, getMetadata, isDisabled, isEmpty, isNameChangeAllowed, keySet, put, putAll, refresh, remove, remove, size, update, update, validate, values
getName, getPath, getService, getTitle, getUpdated, invalidate
clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait
compute, computeIfAbsent, computeIfPresent, equals, forEach, getOrDefault, hashCode, merge, putIfAbsent, remove, replace, replace, replaceAll
public Socket attach() throws IOException
IOException
- Throws exception if fails to write socket.public void attachWith(ReceiverBehavior behavior) throws IOException
run
method of the ReceiverBehavior
object, then handles
setting up and tearing down the socket.
For an example of how to use this method, see How to get data into Splunk on dev.splunk.com.
behavior
- The body of a try
block as an anonymous
implementation of the ReceiverBehavior
interface.IOException
- The IOException classpublic Socket attach(Args args) throws IOException
args
- Optional arguments for this stream. Valid parameters are:
"host", "host_regex", "source", and "sourcetype".IOException
- The IOException classpublic Index clean(int maxSeconds)
maxSeconds
- The maximum number of seconds to wait before returning.
A value of -1 means to wait forever.SplunkException
- If cleaning timed out or
if the thread was interrupted.public boolean getAssureUTF8()
true
if the retrieved data is in UTF8, false
if
not.public int getBloomfilterTotalSizeKB()
public String getBucketRebuildMemoryHint()
public String getColdPath()
null
if
not specified.public String getColdPathExpanded()
null
if not specified.public String getColdToFrozenDir()
null
if not
specified.public String getColdToFrozenScript()
For more info about archiving scripts, see the POST data/indexes endpoint in the REST API documentation.
null
if not specified.getColdToFrozenDir()
public boolean getCompressRawdata()
true
if raw data is compressed, false
if not.public int getCurrentDBSizeMB()
public String getDefaultDatabase()
public boolean getEnableOnlineBucketRepair()
When this feature is enabled, you don't have to wait for buckets to be repaired before starting Splunk, but you might notice a slight degradation in performance as a result.
true
if bucket repair is enabled, false
if
not.public boolean getEnableRealtimeSearch()
true
if real-time search is enabled, false
if
not.public int getFrozenTimePeriodInSecs()
coldToFrozen
attributes.public String getHomePath()
null
if not specified.public String getHomePathExpanded()
null
if not specified.public String getIndexThreads()
public String getLastInitTime()
null
if not specified.public String getMaxBloomBackfillBucketAge()
public int getMaxConcurrentOptimizes()
public String getMaxDataSize()
setMaxDataSize(java.lang.String)
public String getMaxHotBuckets()
public int getMaxHotIdleSecs()
public int getMaxHotSpanSecs()
public int getMaxMemMB()
public int getMaxMetaEntries()
public int getMaxRunningProcessGroups()
public Date getMaxTime()
null
if not specified.public int getMaxTotalDataSizeMB()
public int getMaxTimeUnreplicatedNoAcks()
MaxTimeUnreplicatedWithAcksparamater
applies instead.getMaxTimeUnreplicatedWithAcks()
public int getMaxTimeUnreplicatedWithAcks()
public int getMaxWarmDBCount()
public String getMemPoolMB()
public String getMinRawFileSyncSecs()
A value of "disable" disables this feature completely, while a value of 0 forces a file-system sync after completing compression of every journal slice.
public Date getMinTime()
null
if not specified.public int getNumHotBuckets()
public int getNumWarmBuckets()
public int getNumBloomfilters()
public int getPartialServiceMetaPeriod()
ServiceMetaPeriod
interval.getServiceMetaPeriod()
,
setServiceMetaPeriod(int)
public int getQuarantineFutureSecs()
public int getQuarantinePastSecs()
public int getRawChunkSizeBytes()
public int getRotatePeriodInSecs()
public int getServiceMetaPeriod()
public String getSuppressBannerList()
public int getSync()
public boolean getSyncMeta()
true
if the sync operation is called before the file
descriptor is closed on metadata updates, false
if not.public String getThawedPath()
null
if not
specified.public String getThawedPathExpanded()
null
if not specified.public int getThrottleCheckPeriod()
public int getTotalEventCount()
public boolean isInternal()
true
if this index is an internal index, false
if not.public void rollHotBuckets()
public void setAssureUTF8(boolean assure)
Note: Indexing performance degrades when this parameter is set to
true
.
In Splunk 5.0 and later, this is a global property and cannot be set on
a per-index basis.
assure
- true
to ensure UTF8 encoding, false
if not.public void setBlockSignSize(int value)
value
- The event count for block signing.public void setBucketRebuildMemoryHint(String value)
value
- The suggested size of the .tsidx file for the bucket rebuild
process.public void setColdToFrozenDir(String destination)
Splunk rebuild
<bucket dir>
on the bucket, then move the buckets to the thawed
directory.coldToFrozenDir
and coldToFrozenScript
are
specified, coldToFrozenDir
takes precedence.destination
- The destination path for the frozen archive.setColdToFrozenScript(java.lang.String)
,
getColdToFrozenScript()
public void setColdToFrozenScript(String script)
For more info about archiving scripts, see the POST data/indexes endpoint in the REST API documentation.
script
- The path to the archiving script.setColdToFrozenDir(java.lang.String)
,
getColdToFrozenDir()
public void setEnableOnlineBucketRepair(boolean value)
When this feature is enabled, you don't have to wait for buckets to be repaired before starting Splunk, but you might notice a slight degradation in performance as a result.
value
- true
to enable online bucket repair, false
if not.public void setFrozenTimePeriodInSecs(int seconds)
coldToFrozenDir
and coldToFrozenScript
.seconds
- The time, in seconds, after which indexed data rolls to
frozen.setColdToFrozenDir(java.lang.String)
,
setColdToFrozenScript(java.lang.String)
public void setMaxBloomBackfillBucketAge(String time)
time
- The time that indicates a bucket age.public void setMaxConcurrentOptimizes(int processes)
processes
- The number of concurrent optimize processes.public void setMaxDataSize(String size)
size
- The size in MB, or an autotune string.getMaxDataSize()
public void setMaxHotBuckets(String size)
When maxHotBuckets
is exceeded, Splunk rolls the least recently
used (LRU) hot bucket to warm. Both normal hot buckets and quarantined
hot buckets count towards this total. This setting operates independently
of MaxHotIdleSecs
, which can also cause hot buckets to roll.
size
- The maximum number of hot buckets per index, or an 'auto' string.setMaxHotIdleSecs(int)
,
getMaxHotIdleSecs()
public void setMaxHotIdleSecs(int seconds)
If a hot bucket exceeds this value, Splunk rolls it to warm.
This setting operates independently of MaxHotBuckets
, which can
also cause hot buckets to roll.
seconds
- The hot bucket's maximum lifetime, in seconds. A value of
0 means an infinite lifetime.setMaxHotBuckets(java.lang.String)
,
getMaxHotBuckets()
public void setMaxHotSpanSecs(int seconds)
Note: If you set this too small, you can get an explosion of hot and warm buckets in the file system. The system sets a lower bound implicitly for this parameter at 3600, but this advanced parameter should be set with care and understanding of the characteristics of your data.
seconds
- The upper bound of the target maximum timespan, in
seconds.public void setMaxMemMB(int memory)
memory
- The amount of memory, in MB.public void setMaxMetaEntries(int entries)
If this value is exceeded, a hot bucket is rolled to prevent a further increase. If your buckets are rolling due to Strings.data hitting this limit, the culprit might be the "punct" field in your data. If you don't use that field, it might be better to just disable this (see the props.conf.spec in $SPLUNK_HOME/etc/system/README).
entries
- The maximum number of unique lines. A value of 0 means
infinite lines.public void setMaxTimeUnreplicatedNoAcks(int value)
MaxTimeUnreplicatedWithAcksparamater
applies instead.value
- The upper limit, in seconds. A value of 0 disables this
setting.public void setMaxTimeUnreplicatedWithAcks(int value)
This number should not exceed the acknowledgement timeout configured on any forwarder.
value
- The upper limit, in seconds. A value of 0 disables this
setting (not recommended).public void setMaxTotalDataSizeMB(int size)
size
- The maximum index size, in MB.public void setMaxWarmDBCount(int buckets)
buckets
- The maximum number of warm buckets.public void setMinRawFileSyncSecs(String frequency)
frequency
- The file-system sync frequency, as an integer or
"disable".public void setPartialServiceMetaPeriod(int frequency)
ServiceMetaPeriod
interval.frequency
- The metadata sync interval, in seconds.setServiceMetaPeriod(int)
,
getServiceMetaPeriod()
public void setQuarantineFutureSecs(int window)
window
- The future event-time quarantine, in seconds.public void setQuarantinePastSecs(int window)
window
- The past event-time quarantine, in seconds.public void setRawChunkSizeBytes(int size)
This parameter only specifies a target chunk size. The actual chunk size might be slightly larger by an amount proportional to an individual event size.
WARNING: This is an advanced parameter. Only change it if you are instructed to do so by Splunk Support.
size
- The target uncompressed size, in bytes. (0 is not a valid
value--if 0 is used, this parameter is set to the default value.)public void setRotatePeriodInSecs(int frequency)
frequency
- The check frequency, in seconds.public void setServiceMetaPeriod(int frequency)
frequency
- The meta data sync frequency, in seconds.public void setSyncMeta(boolean sync)
This functionality improves the integrity of metadata files, especially with regard to operating system crashes and machine failures.
WARNING: This is an advanced parameter. Only change it if you are instructed to do so by Splunk Support.
sync
- true
to call the sync operation before the file
descriptor is closed on metadata updates, false
if not.public void setThrottleCheckPeriod(int frequency)
frequency
- The frequency of the throttling check, in seconds.public void submit(String data)
data
- The event data to post.public void submit(Args args, String data)
args
- Optional arguments for this request. Valid parameters are:
"host", "host_regex", "source", and "sourcetype".data
- The event data to post.public void upload(String filename)
Note: This file must be directly accessible by the Splunk server.
filename
- The path and filename.public void upload(String filename, Args args)
Note: This file must be directly accessible by the Splunk server.
filename
- The path and filename.args
- Optional arguments for this request. Valid parameters are:
"host", "sourcetype", "rename-source". More found at:
http://docs.splunk.com/Documentation/Splunk/latest/RESTAPI/RESTinput#data.2Finputs.2FoneshotCopyright © 2022 Splunk, Inc.. All rights reserved.