topic Not able to create '_introspection' index in Getting Data In

Not able to create '_introspection' index

thezero — Tue, 29 Sep 2020 08:01:43 GMT

Hi Team,

I am getting below error message when I am trying to create new index 'introspection'.
Error:
In handler 'indexes': invalid name: '_introspection'. name parameter must be non-empty and cannot start with '' or '-'

Scenario:
We have recently upgraded our heavy weight forwarder and indexer is still running an older version.After HWF upgarded we received few warning messages in GUI like "received event for unconfigured/disabled/deletd index index="_introspection".Now splunk not allowing to create index _introspection.How can I resolve this?Please advise

Re: Not able to create '_introspection' index

Lucas_K — Tue, 29 Sep 2020 08:03:37 GMT

See if you can create it via a local indexes.conf edit and not via the gui.

This is what it looks like in newer versions.

[_introspection]
homePath = $SPLUNK_DB/_introspection/db
coldPath = $SPLUNK_DB/_introspection/colddb
thawedPath = $SPLUNK_DB/_introspection/thaweddb
maxDataSize = 1024
frozenTimePeriodInSecs = 1209600

I am sure I did exactly this on some older indexers when customers updated their forwarders before we upgraded our own machines.

Re: Not able to create '_introspection' index

javiergn — Wed, 02 Dec 2015 16:45:57 GMT

See if this helps.
Keep in mind you can't manually create new indexes that start with _ because that is reserved for Splunk internal ones. Internal indexes don't count towards the license so it's easy to guess why this is not permitted 🙂

Re: Not able to create '_introspection' index

javiergn — Wed, 02 Dec 2015 16:48:10 GMT

This might help too