topic Re: Unable to add CIFS share as frozen path in Getting Data In

Unable to add CIFS share as frozen path

matchpump — Mon, 15 Aug 2016 08:24:31 GMT

I'm trying to create a new index and specify a CIFS share as "Frozen Path". But I got an error "Unable to load index configuration: In index 'index1': Failed to create directory '\192.168.110.140\archive\index1\' (指定されたパスは無効です。)
"指定されたパスは無効です。" is translated into "specified path is invalid"(This message seems generated from Windows OS because the locale setting of splunk is english on Japanese Windows OS).
I can access the path above from explorer, so I believe it's not a access privilege problem.
I also tested to add drive letter for the path( \192.168.110.140\archive\index1\ -> Y:).
This work fine. But I can't set the path to Y:xxx. I got the same error as above.

Any advise or thoughts is welcome!

Thanks.

Re: Unable to add CIFS share as frozen path

jkat54 — Mon, 15 Aug 2016 14:36:47 GMT

Shouldn't it be y:\ ?

Are you testing as the same user that splunk runs as?

Re: Unable to add CIFS share as frozen path

matchpump — Tue, 16 Aug 2016 02:52:24 GMT

Yes, y: is just a typo.
Splunk is running as administrator as same as the testing user.

The number of the index will be much more than the number of alphabets.
So the frozen path is needed to be subdirectory of a drive letter.

Re: Unable to add CIFS share as frozen path

schose — Tue, 16 Aug 2016 14:21:34 GMT

if Splunk is running as system user the share and filesystem have to be writeable for the account "domain\computername$".

For troubleshooting select a useraccount which is local admin and let splunk run in this account. Try to create a file with this account.

Otherwise use psexec -s from sysinternals to test Share and filesystem right as system user.

Regards,

Andreas