Closed borischen closed 12 years ago
While Splunk only sends one argument, an other argument can be passed in the conf file.
ColdToFrozenScript = "/path/to/file/archiveBucket.sh index-name"
Here index-name is the first argument, the index name, and the second argument will be passed by Splunk.
Why did we do this: While the default configuration of the bucket path reveals the index-name the indexes.conf can be changed so that the path of the bucket is stored without the index-name being a part of the path.
Okay.
The script should check for mis-configuration. It's not usual to call frozen scripts like this, and so it took me quite a while to figure out what was wrong. (at the very least, the script having comments on how to use it would be helpful)
I'll have to back out my change
it's backed out by petter, but i think we should do better error checking
added error checking
index=$1 bucket=$2
This is wrong, since splunk will not pass a second argument, and this results in an error.
What we should do is derive the index from the bucket path just like the sample script in coldToFrozenExample.py