topic splunk index in Getting Data In

splunk index

kowsikreddy — Wed, 11 Nov 2020 08:18:42 GMT

We are on migration on 2 different environments for windows OS.

Can we get details, where we have define new indexes in the indexer server?

Re: splunk index

gcusello — Wed, 11 Nov 2020 12:47:27 GMT

Hi @kowsikreddy,

you can see the location of each index in [Settings -- Indexes] - Home Path.

If you have $SPLUNK_DB, by default it's:

$SPLUNK_HOME\var\lib\splunk

otherwise it's defined in the conf file

$SPLUNK_HOME\etc\splunk-launch.conf

Ciao.

Giuseppe

Re: splunk index

brent_weaver — Wed, 11 Nov 2020 13:06:19 GMT

It is possible that these indexes are defined outside the $SPLUNK_HOME so you may want to write a little power shell script to find the indexes.conf file to see where things are defined. I have fully qualified paths in my indexes.conf file.

if it is an index cluster they would need to be configured in master apps directory on the cluster master server