tsidxWritingLevel field is empty when calling Splunk REST API

Dominik_K — Mon, 28 Dec 2020 14:10:35 GMT

Splunk version: 8.1.1
OS: CentOS 7.9

My indexes.conf file looks like this:

[default] tsidxWritingLevel = 4 [mynewindex] coldPath = $SPLUNK_DB/mynewindex/colddb enableDataIntegrityControl = 0 enableTsidxReduction = 0 homePath = $SPLUNK_DB/mynewindex/db maxTotalDataSizeMB = 512000 thawedPath = $SPLUNK_DB/mynewindex/thaweddb tsidxWritingLevel = 4

What is my goal?
I want to ensure that tsidxWritingLevel = 4 is actually set up and is working.

So I ran an API query in Splunk:

| rest /services/data/indexes

But tsidxWritingLevel field is empty all the way down. Why is that? How can check that Splunk is actually using tsidxWritingLevel = 4?

Output from btool:

[root@localhost local]# /opt/splunk/bin/splunk btool indexes list --debug | grep local /opt/splunk/etc/system/local/indexes.conf journalCompression = zstd /opt/splunk/etc/system/local/indexes.conf tsidxWritingLevel = 4 /opt/splunk/etc/system/local/indexes.conf [_internal] /opt/splunk/etc/system/local/indexes.conf journalCompression = zstd /opt/splunk/etc/system/local/indexes.conf tsidxWritingLevel = 4 /opt/splunk/etc/system/local/indexes.conf journalCompression = zstd /opt/splunk/etc/system/local/indexes.conf tsidxWritingLevel = 4 /opt/splunk/etc/system/local/indexes.conf journalCompression = zstd /opt/splunk/etc/system/local/indexes.conf tsidxWritingLevel = 4 /opt/splunk/etc/system/local/indexes.conf journalCompression = zstd /opt/splunk/etc/system/local/indexes.conf tsidxWritingLevel = 4 /opt/splunk/etc/system/local/indexes.conf journalCompression = zstd /opt/splunk/etc/system/local/indexes.conf tsidxWritingLevel = 4 /opt/splunk/etc/system/local/indexes.conf journalCompression = zstd /opt/splunk/etc/system/local/indexes.conf tsidxWritingLevel = 4 /opt/splunk/etc/system/local/indexes.conf [default] /opt/splunk/etc/system/local/indexes.conf journalCompression = zstd /opt/splunk/etc/system/local/indexes.conf tsidxWritingLevel = 4 /opt/splunk/etc/system/local/indexes.conf journalCompression = zstd /opt/splunk/etc/system/local/indexes.conf tsidxWritingLevel = 4 /opt/splunk/etc/system/local/indexes.conf journalCompression = zstd /opt/splunk/etc/system/local/indexes.conf tsidxWritingLevel = 4 /opt/splunk/etc/apps/search/local/indexes.conf [mynewindex] /opt/splunk/etc/apps/search/local/indexes.conf coldPath = $SPLUNK_DB/mynewindex/colddb /opt/splunk/etc/apps/search/local/indexes.conf enableDataIntegrityControl = 0 /opt/splunk/etc/apps/search/local/indexes.conf enableTsidxReduction = 0 /opt/splunk/etc/apps/search/local/indexes.conf homePath = $SPLUNK_DB/mynewindex/db /opt/splunk/etc/system/local/indexes.conf journalCompression = zstd /opt/splunk/etc/apps/search/local/indexes.conf maxTotalDataSizeMB = 512000 /opt/splunk/etc/apps/search/local/indexes.conf thawedPath = $SPLUNK_DB/mynewindex/thaweddb /opt/splunk/etc/apps/search/local/indexes.conf tsidxWritingLevel = 4 /opt/splunk/etc/system/local/indexes.conf journalCompression = zstd /opt/splunk/etc/system/local/indexes.conf tsidxWritingLevel = 4 /opt/splunk/etc/system/local/indexes.conf journalCompression = zstd /opt/splunk/etc/system/local/indexes.conf tsidxWritingLevel = 4 /opt/splunk/etc/system/local/indexes.conf journalCompression = zstd /opt/splunk/etc/system/local/indexes.conf tsidxWritingLevel = 4

Re: tsidxWritingLevel field is empty when calling Splunk REST API

Dominik_K — Mon, 28 Dec 2020 14:58:34 GMT

I tried to run different API call in Splunk

| rest /services/configs/conf-indexes

And this one is actually returning tsidxWritingLevel field showing value 4.

topic Re: tsidxWritingLevel field is empty when calling Splunk REST API in Splunk Enterprise

tsidxWritingLevel field is empty when calling Splunk REST API

Re: tsidxWritingLevel field is empty when calling Splunk REST API