topic Re: Indexer _internal size under /opt/splunk/var/lib is large in Getting Data In

Indexer _internal size under /opt/splunk/var/lib is large

jordanking1992 — Mon, 04 Nov 2019 13:59:17 GMT

Hello,

We have an indexer cluster that has a custom indexes.conf that specifies the volume path and retention of each index.
However, it appears the _internal DB on each of the indexers it writing to /opt/splunk/var/lib instead of our custom volume where all the other indexes are writing. This is causing our /opt/splunk filesystem to fill up.

Can someone explain why the indexers are not sending their _internaldb logs to /opt/splunk_hot even though we are referencing the volume in _internal? The ellipses are all the other indexes in the indexes.conf

indexes.conf

# VOLUME SETTINGS
# One Volume for Hot and Cold
[volume:primary]
path = /opt/splunk_hot

[volume:secondary]
path = /opt/splunk_cold
....
[_internal]
repFactor = auto
homePath   = volume:primary/_internal/db
coldPath   = volume:secondary/_internaldb/colddb
thawedPath = /opt/splunk_cold/_internaldb/thaweddb

Re: Indexer _internal size under /opt/splunk/var/lib is large

sathwikr076 — Mon, 04 Nov 2019 16:14:08 GMT

Hello,

did you mention your primary volume path at /opt/splunk/etc/splunk-launch.conf. if you did not mention your path their, the buckets will go to the default location which is /opt/splunk/var/lib/splunk.
Thanks.

Re: Indexer _internal size under /opt/splunk/var/lib is large

jordanking1992 — Wed, 30 Sep 2020 02:52:26 GMT

Hey, i had no idea about this setting. So if i put the SPLUNK_DB path to /opt/splunk_hot, will that affect any of my other indexes? Keep in mind, all indexes excluding _internal are correctly sending to /opt/splunk_hot. I would've assume explicitly setting the path's above (which are not referencing SPLUNK_DB) woulve work...

Re: Indexer _internal size under /opt/splunk/var/lib is large

sathwikr076 — Wed, 30 Sep 2020 02:52:28 GMT

Can you let me know if there is any difference in indexes.conf between _internal index and other indexes which is why they are going to your actual path.
yes, if you add Splunk_DB path it will apply to all the indexes.

Re: Indexer _internal size under /opt/splunk/var/lib is large

FrankVl — Fri, 08 Nov 2019 15:47:00 GMT

I guess there is another config file somewhere that takes precedence. Try btool to see what the effective configuration is for that index and what file it comes from.

Re: Indexer _internal size under /opt/splunk/var/lib is large

codebuilder — Fri, 08 Nov 2019 22:55:36 GMT

Assuming the config you provided is what you've actually deployed, the answer is hiding in plain sight 🙂

There is an error in your homePath declaration.

 homePath   = volume:primary/_internal/db

Should be:

 homePath   = volume:primary/_internaldb/db

Re: Indexer _internal size under /opt/splunk/var/lib is large

jordanking1992 — Wed, 30 Sep 2020 02:56:08 GMT

Hey, thanks for the reply. However, Splunk doesn't care what the name of the directory is as long as that directory never changes. When an index is created using [], Splunk knows to write and read data from the directory paths specified under this stanza.

The solution to my problem was what @sathwikr076 mentioned. By changed the DB_PATH under /opt/splunk/etc/splunk-launch.conf, data for the _internal index began writing to splunk_hot like anticipated.

Thank you for your response though!

Re: Indexer _internal size under /opt/splunk/var/lib is large

codebuilder — Mon, 11 Nov 2019 14:59:07 GMT

Ah, good to know! And glad you got it resolved!