topic Can the _introspection index use SmartStore? in Knowledge Management

Can the _introspection index use SmartStore?

esalesapns2 — Wed, 03 Apr 2019 14:03:54 GMT

I created a fresh index cluster in AWS using the Splunk AMI, upgraded to 7.2.5.1.

In the "Configure SmartStore" doc, Splunk says, "The following indexes.conf settings must remain unset: bloomHomePath sumaryHomePath tstatsHomePath."

To try to enforce this on all indexes, in my master node, I created indexes.conf in etc/master-apps/_cluster/local and put in:

bloomHomePath =
summaryHomePath =
tstatsHomePath =

When I run "splunk validate cluster-bundle" I don't get an error, but when I then run "splunk show cluster-bundle-status" it says,

[Critical] stanza=_introspection Required parameter=tstatsHomePath not configured

Unless I remove the tstatsHomePath setting, the bundle won't validate.

Re: Can the _introspection index use SmartStore?

dm1 — Tue, 09 Nov 2021 04:57:34 GMT

were you able to fix this ?

Re: Can the _introspection index use SmartStore?

isoutamo — Tue, 09 Nov 2021 06:42:02 GMT

Hi
In this context unsetting means that you shouldn't put anything in those and you must use defaults here. In previous examples you just unset those, which is different thing than use default. You cannot set any value (including unset) in your indexes.conf. Just remove those definitions from it and use what ever comes from system/default/indexes.conf.
r. Ismo

Re: Can the _introspection index use SmartStore?

dm1 — Thu, 20 Jan 2022 05:11:05 GMT

If you refer to this page https://docs.splunk.com/Documentation/Splunk/8.2.4/Indexer/ConfigureSmartStore#Settings_in_indexes.conf_that_are_incompatible_with_SmartStore_or_otherwise_restricted

there are settings which are "must remain unset" and settings that "must retain their default values", but as per your comment, both should mean the same, isnt it ?

if keeping them unset is keeping them as default, why would Splunk doc put these settings in differently ?

Re: Can the _introspection index use SmartStore?

isoutamo — Thu, 20 Jan 2022 06:24:58 GMT

My understanding is that those means same, but I suggest that you ask that on those docs pages. Splunk usually answers and clarify those quite soon.

Re: Can the _introspection index use SmartStore?

dm1 — Fri, 21 Jan 2022 02:22:47 GMT

I have asked them still waiting on for response.