topic Re: Why am I unable to see cold path in Splunk? in Getting Data In

Why am I unable to see cold path in Splunk?

kteng2024 — Tue, 28 Feb 2017 23:13:37 GMT

for an index, i specified the following:

[abc]
homePath = $SPLUNK_DB/abc/db
coldPath = $SPLUNK_DB/abc/colddb
thawedPath = $SPLUNK_DB/abc/thaweddb

since i used "$SPLUNK_DB" i don't see it in /var/lib/splunk , so can i please know where i could see those directories?

Re: Why am I unable to see cold path in Splunk?

somesoni2 — Tue, 28 Feb 2017 23:15:16 GMT

Did you check in $SPLUNK_HOME/var/lib/splunk ?

Re: Why am I unable to see cold path in Splunk?

woodcock — Wed, 01 Mar 2017 02:03:14 GMT

The SPLUNK_DB environment variable is defaulted in the software as follows (from $SPLUNK_HOME/etc/splunk-launch.conf😞

By default, Splunk stores its indexes under SPLUNK_HOME in the

var\lib\splunk subdirectory. This can be overridden

here:

SPLUNK_DB=C:\wrangler-2.0\build-home\ivory\var\lib\splunk

Therefore, your files should be found (if there are no splunk-launch.conf files that modify the default) inside $SPLUNK_HOME/var/lib/splunk/ which for linux with a standard installation should be /opt/splunk/var/lib/splunk/.