topic Re: Move Index Configeration Entry in Splunk Dev

Move Index Configeration Entry

hartfoml — Fri, 17 May 2013 17:31:22 GMT

I used the CLI to create two indexes.

The entry was put in the splunk/etc/apps/search/local/index.conf file
I wanted it in the splunk/etc/system/local/index.conf file

Does this make a difference???
If I need to how can i move the config info to the new config file without breaking the index or deleting and recreating?

What did I do wrong that it created the indexes in the search app rather than in the system folder?

Re: Move Index Configeration Entry

kristian_kolb — Fri, 17 May 2013 19:32:21 GMT

Ah, rest easy. You can move the configuration to /etc/system/local. This is just the definition of the index, not the index itself. No need to clean/re-index.

Oh, and by the way, you did nothing wrong. In this case it does not really make a difference, since the 'search' app cannot be disabled. However, I for one like to have these types (index-time related) of conf in one place, and I prefer to edit by hand so I know where they are. Other types, like of conf, like field extractions, eventtypes, saved searches etc can, and often should, be set in different apps.

See http://docs.splunk.com/Documentation/Splunk/5.0.2/Admin/Wheretofindtheconfigurationfiles

To 'fix' this:
1. Stop splunk.
2. Move the file (or rather the contents, as you might already have an indexes.conf in /etc/system/local).
3. Start splunk.

Re: Move Index Configeration Entry

hartfoml — Mon, 20 May 2013 14:48:39 GMT

Thanks so much for the help and this is probably the correct answer. I can't test it because I can't stop spunkd during the work day. Do you know of a way to update the info without stopping the service???

Re: Move Index Configeration Entry

kristian_kolb — Tue, 21 May 2013 05:22:33 GMT

Don't think so. You can edit the files before you stop/restart. So it's only a stop for about a minute or so.