topic Re: Why am I getting error "Cannot create index 'main': path of coldToFrozenDir must be absolute" trying to move/archive files on Windows? in Getting Data In

Why am I getting error "Cannot create index 'main': path of coldToFrozenDir must be absolute" trying to move/archive files on Windows?

hagjos43 — Mon, 21 Dec 2015 20:36:09 GMT

I'm working in a test lab trying to move/archive files using the following indexes.conf file on our cluster master:

[main]
repFactor = auto
homePath   = $SPLUNK_DB\defaultdb\db
coldPath   = $SPLUNK_DB\defaultdb\colddb
thawedPath = $SPLUNK_DB\defaultdb\thaweddb
maxWarmDBCount = 2
maxDataSize = auto_high_volume
frozenTimePeriodInSecs = 86400
coldToFrozenDir = "$SPLUNK_HOME\Archive\defaultdb"

I'm getting the following error when trying to distribute it:

Vader:Cannot create index 'main': path of coldToFrozenDir must be absolute ('"C:\Program Files\Splunk"')
Palpatine:Cannot create index 'main': path of coldToFrozenDir must be absolute ('"C:\Program Files\Splunk"')

Any ideas?

Thanks,
Joe

Re: Why am I getting error "Cannot create index 'main': path of coldToFrozenDir must be absolute" trying to move/archive files on Windows?

jerniganbrandon — Mon, 21 Dec 2015 21:04:15 GMT

Dumb question, but do you have defaultdb created in C:\Program Files\Splunk\Archive\?

Re: Why am I getting error "Cannot create index 'main': path of coldToFrozenDir must be absolute" trying to move/archive files on Windows?

hagjos43 — Tue, 22 Dec 2015 11:16:27 GMT

I do not, should I?
First time doing this.

Thanks,
Joe

Re: Why am I getting error "Cannot create index 'main': path of coldToFrozenDir must be absolute" trying to move/archive files on Windows?

jmallorquin — Tue, 22 Dec 2015 12:07:39 GMT

Hi,

You have to setup

coldToFrozenDir = C:\Program Files\Splunk\Archive\defaultdb"

Hope help you

Re: Why am I getting error "Cannot create index 'main': path of coldToFrozenDir must be absolute" trying to move/archive files on Windows?

hagjos43 — Tue, 22 Dec 2015 17:02:46 GMT

I modified my indexes.conf to reflect this and it did not work:

[main]
repFactor = auto
homePath   = $SPLUNK_DB\defaultdb\db
coldPath   = $SPLUNK_DB\defaultdb\colddb
thawedPath = $SPLUNK_DB\defaultdb\thaweddb
maxWarmDBCount = 2
maxDataSize = auto_high_volume
frozenTimePeriodInSecs = 86400
coldToFrozenDir = "C:\Program Files\Splunk\Archive\defaultdb"

Still getting:

Cannot create index 'main': path of coldToFrozenDir must be absolute ('"C:\Program Files\Splunk\Archive\defaultdb"')

Re: Why am I getting error "Cannot create index 'main': path of coldToFrozenDir must be absolute" trying to move/archive files on Windows?

hagjos43 — Tue, 22 Dec 2015 17:11:58 GMT

I figured out my issue....a simple typo was causing the issue.

For reference this is what I had:

 [main]
 repFactor = auto
 homePath   = $SPLUNK_DB\defaultdb\db
 coldPath   = $SPLUNK_DB\defaultdb\colddb
 thawedPath = $SPLUNK_DB\defaultdb\thaweddb
 maxWarmDBCount = 2
 maxDataSize = auto_high_volume
 frozenTimePeriodInSecs = 86400
 coldToFrozenDir = "C:\Program Files\Splunk\Archive\defaultdb"

This is what I did to fix it (remove the quotes around the coldToFrozenDir path and add $SPLUNK_HOME):

[main]
repFactor = auto
homePath   = $SPLUNK_DB\defaultdb\db
coldPath   = $SPLUNK_DB\defaultdb\colddb
thawedPath = $SPLUNK_DB\defaultdb\thaweddb
maxWarmDBCount = 2
maxDataSize = auto_high_volume
frozenTimePeriodInSecs = 86400
coldToFrozenDir = $SPLUNK_HOME\Splunk\Archive\defaultdb

Re: Why am I getting error "Cannot create index 'main': path of coldToFrozenDir must be absolute" trying to move/archive files on Windows?

jerniganbrandon — Tue, 22 Dec 2015 17:13:45 GMT

Go ahead and create the directory structure and see if that works. It is probably complaining that the directory doesn't exist, so it isn't able to write the index files.

Re: Why am I getting error "Cannot create index 'main': path of coldToFrozenDir must be absolute" trying to move/archive files on Windows?

jmallorquin — Tue, 22 Dec 2015 17:13:55 GMT

No quotes

coldToFrozenDir = C:\Program Files\Splunk\Archive\defaultdb

hope help you

Re: Why am I getting error "Cannot create index 'main': path of coldToFrozenDir must be absolute" trying to move/archive files on Windows?

jerniganbrandon — Tue, 22 Dec 2015 17:19:55 GMT

Ah, that error message makes sense now with the double quoting. Good catch!

Re: Why am I getting error "Cannot create index 'main': path of coldToFrozenDir must be absolute" trying to move/archive files on Windows?

hagjos43 — Tue, 22 Dec 2015 17:23:01 GMT

So it works, but my buckets did not move. They were simply deleted out of the following directory:

$SPLUNK_HOME\var\lib\splunk\defaultdb\colddb

Any suggestions?

Re: Why am I getting error "Cannot create index 'main': path of coldToFrozenDir must be absolute" trying to move/archive files on Windows?

hagjos43 — Tue, 22 Dec 2015 17:42:43 GMT

Eh I think I found my second issue..... man I'm full of typos and out of coffee today.... SMH.

Looks like:

coldToFrozenDir = $SPLUNK_HOME\Splunk\Archive\defaultdb

Should really be:

coldToFrozenDir = $SPLUNK_HOME\Archive\defaultdb