topic Get indexes API not returning expanded home and cold path. Splunk Version: 9.4.5 in Splunk Enterprise

Get indexes API not returning expanded home and cold path. Splunk Version: 9.4.5

Commvault — Fri, 07 Nov 2025 05:53:42 GMT

I am calling this API: GET /services/data/indexes/<index-name>

The values of homePath_expanded and coldPath_expanded are not being resolved to return the absolute path, but it returns the following data:

<s:key name="homePath_expanded">volume:hotwarm/$_index_name/db</s:key>

<s:key name="coldPath_expanded">volume:cold/$_index_name/colddb</s:key>

Can someone please help me if I can check something to resolve this?

Re: Get indexes API not returning expanded home and cold path. Splunk Version: 9.4.5

PrewinThomas — Fri, 07 Nov 2025 06:26:54 GMT

@Commvault

The API is returning volume:hotwarm/... instead of an absolute filesystem path because your index is defined using volume references in indexes.conf. Splunk does not expand those into full paths unless the volume stanza itself has an absolute path configured.

you can combine the two REST endpoints (/services/data/indexes and /services/data/index-volumes) to show full path.
Try something below,

| rest /services/data/indexes | fields title homePath_expanded coldPath_expanded | rex field=homePath_expanded "(?<homeVol>volume:[^/]+)" | rex field=coldPath_expanded "(?<coldVol>volume:[^/]+)" | join type=left homeVol [ | rest /services/data/index-volumes | fields title volume_path | rename title as homeVol volume_path as homeBase ] | join type=left coldVol [ | rest /services/data/index-volumes | fields title volume_path | rename title as coldVol volume_path as coldBase ] | eval homePathResolved=replace(homePath_expanded,homeVol,homeBase) | eval coldPathResolved=replace(coldPath_expanded,coldVol,coldBase) | table title homePathResolved coldPathResolved

Regards,
Prewin
🌟If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!

Re: Get indexes API not returning expanded home and cold path. Splunk Version: 9.4.5

Commvault — Tue, 11 Nov 2025 06:38:05 GMT

Hi @PrewinThomas

I do have the following data in the indexes.conf file:

[volume:cold]
path = /splunk-data/cold

[volume:hotwarm]
path = /splunk-data/hotwarm
maxVolumeDataSizeMB = 4500000

[wineventlog]
homePath = volume:hotwarm/$_index_name/db
coldPath = volume:cold/$_index_name/colddb
tstatsHomePath = volume:hotwarm/$_index_name/datamodel_summary
thawedPath = /splunk-data/cold/$_index_name/thaweddb

Are there any logs that will tell if there was an issue in resolving these paths?