topic How do I fix this error? : Problem parsing indexes.conf: stanza=fireeye Required parameter=homePath not configured in Getting Data In

How do I fix this error? : Problem parsing indexes.conf: stanza=fireeye Required parameter=homePath not configured

packet_hunter — Thu, 07 Sep 2017 14:15:27 GMT

I am trying to send json data via Http post to Splunk's API on an HF (heavy forwarder). I can see with wireshark that the appliance sending the json data is connecting and pushing data to the API, but it is not making it into the indexers.

In the var log I see this error
Problem parsing indexes.conf: stanza=fireeye Required parameter=homePath not configured

When I add the my stanza [fireeye] to the indexes.conf file in etc/system/local and restart the fwder, splunkd will not restart until I remove it.

Any ideas?

Re: How do I fix this error? : Problem parsing indexes.conf: stanza=fireeye Required parameter=homePath not configured

packet_hunter — Tue, 29 Sep 2020 15:37:43 GMT

My bad, user error. Too many cooks in the kitchen.
I did not remember that when you create an index with the gui on a fwder it will put the indexes.conf file in the Search app.
After correcting the indexes.conf file under etc system local like this:
[fireeye]
homePath = $SPLUNK_DB\fireeye\db
coldPath = $SPLUNK_DB\fireeye\colddb
thawedPath = $SPLUNK_DB\fireeye\thaweddb
disabled = false

its working now...

Thank you