[archivebuckets-command] syntax = archivebuckets [forcerun=1] [retries=N] shortdesc = Archives Splunk buckets to Hadoop. description = Archives Splunk buckets to Hadoop. The archivebuckets command is usually run on a schedule by Splunk. The optional argument "forcerun=1" is needed when the search is run manually.\ The optional argument "retries" can be used to specify the number of attempts that should be made to assure all buckets have archived. The default is 1.\ Failures (e.g. due to lost network connectivity) will be retried the next time the command is run.\ archivebuckets will generate virtual index information and spawn a new distributed search named copybuckets, which will archive buckets on each search peer connected to this Splunk instance.\ For more information, visit docs.splunk.com. usage = public example1 = | archivebuckets forcerun=1 comment1 = To execute archivebuckets manually tags = a, ar, arc, archive, buckets, bucket, roll, roller