EDR: How to add a partition_id to cb.core.conf

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Add partition_id field to a core so it is loaded properly

Environment

• EDR Server: 6.x and Higher
• cb.core.conf is missing the partition_id field 

Resolution

1. Copy the partition_id field from the a newer core in /var/cb/data/solr*/cbevents/
2. Paste the value into the affected core
3. Change the last 4 digits to make the ID less than the original ID
4. Restart services

Additional Information

• Cores are named by their creation date. New cores will have a more recent date
• Example
  • cbevents_2020_09_09_2121 is missing the partition_id
  • cbevents_2020_09_15_0307 is newer and has partition_id = 104866724184064
  • cbevents_2020_09_09_2121 cb.core.conf would be updated to have a value like partition_id = 104866724184000