To get the least possible latency, we might want to Shuttl buckets that have rolled to warm.
One way of doing this would be to monitor the filesystem, looking for warm buckets (db_ in the index's db path) with the change in optimize.result for something like:
splunk-optimize-lex complete with rc=0 wrc=[0,2]
Splunk should be done with the bucket at this point, and we should be able to Shuttl/copy it to some storage.
To get the least possible latency, we might want to Shuttl buckets that have rolled to warm.
One way of doing this would be to monitor the filesystem, looking for warm buckets (db_ in the index's db path) with the change in optimize.result for something like: splunk-optimize-lex complete with rc=0 wrc=[0,2] Splunk should be done with the bucket at this point, and we should be able to Shuttl/copy it to some storage.
There's a new Watchable API in Java 7 that we could use. But we'd have to decide if we want to go over to Java 7 already. http://docs.oracle.com/javase/tutorial/essential/io/notification.html