topic Re: Urgent: indexes.conf in Getting Data In

Urgent: indexes.conf

ponto — Thu, 08 Feb 2018 09:39:11 GMT

Could someone tell me where can I find indexes.conf ?
Thanks in advance.

Re: Urgent: indexes.conf

kamlesh_vaghela — Thu, 08 Feb 2018 09:54:43 GMT

hi @ponto,

Can you please check below link?

https://answers.splunk.com/answers/50881/indexes-conf-location.html

Re: Urgent: indexes.conf

ponto — Thu, 08 Feb 2018 11:00:10 GMT

I already read that answer but I can't understand where should I put the command ''enableDataIntegrityControl''. Do you know how can I do ?

Re: Urgent: indexes.conf

kamlesh_vaghela — Thu, 08 Feb 2018 11:19:02 GMT

well, If your index is app specific or app level then store this configuration on app level means create indexes.conf in $SPLUNK_HOME/etc/apps/XXX/local OR if it is generic then create indexes.conf $SPLUNK_HOME/etc/system/local.

enableDataIntegrityControl option may be set under an [] entry.

enableDataIntegrityControl = true|false
* If set to true, hashes are computed on the rawdata slices and stored for
  future data integrity checks
* If set to false, no hashes are computed on the rawdata slices
* It has a global default value of false

eg. indexes.conf

[my_index]
enableDataIntegrityControl = true|false

Please check below link for more detail.

https://docs.splunk.com/Documentation/Splunk/7.0.2/Admin/Indexesconf

Thanks

Re: Urgent: indexes.conf

DUThibault — Thu, 08 Feb 2018 14:42:29 GMT

The shell command line find /opt/splunk -name indexes.conf will find all instances of indexes.conf in the Splunk directory tree.