topic Re: Syntax when creating volumes in Getting Data In

Syntax when creating volumes

thoree — Fri, 04 May 2012 08:08:39 GMT

Hi,

I am trying to create my first Splunk-volume and to set an index to point to this volume. But when I try to start Splunk I get the error-message shown below. My config is shown below the error. Can somebody tell what is wrong in my config? What I want is to define a volume pointing to the directory above the directory for the indexes and then use this volume for all indexes.

Error-message:

Problem parsing indexes.conf: Index stanza 'os' refers to non-existent volume 'v
olume:splunkdata/os/db'
Validating databases (splunkd validatedb) failed with code '1'.  Please file a c
ase online at http://www.splunk.com/page/submit_issue

My config in indexes.conf:

# Volume for lagring av Splunk-data 03.05.2012 (TEE)

[volume:splunkdata]
path = d:/Program Files/Splunk/var/lib/splunk
maxVolumeDataSizeMB = 350000

[os]
homePath = volume:splunkdata/os/db
coldPath = volume:splunkdata/os/colddb
thawedPath = $SPLUNK_DB/os/thaweddb

Re: Syntax when creating volumes

Drainy — Fri, 04 May 2012 08:20:10 GMT

Shouldn't the path be (I may be wrong);

path = d:\Program Files\Splunk\var\lib\splunk

Also, have a look at http://docs.splunk.com/Documentation/Splunk/latest/admin/indexesconf

You need a define a volume per hot, cold etc. The directory structure is included within the volume definition so your index definition would instead be;

[os]
homePath = volume:splunkdatahot/os
coldPath = volume:splunkdatacold/os
thawedPath = $SPLUNK_DB/os/thaweddb

Re: Syntax when creating volumes

thoree — Fri, 04 May 2012 08:40:30 GMT

Thanks for your answer. The problem was that I used the wrong "slashes", should be \ instead of /.

Re: Syntax when creating volumes

thoree — Fri, 04 May 2012 08:41:56 GMT

The problem was that I used wrong "slashes".

Re: Syntax when creating volumes

Drainy — Fri, 04 May 2012 08:42:06 GMT

Awesome. Feel free to click the tick under the arrows on the left to accept just to help others in future 🙂