topic Re: How to open the .tsidx file in Monitoring Splunk

How to open the .tsidx file

muthukrishnan — Wed, 28 Dec 2011 16:47:45 GMT

I seen several file is shown .tsidx under the C:\Program Files\Splunk folder.
I want to know how to open that file.

Re: How to open the .tsidx file

MHibbin — Wed, 28 Dec 2011 17:10:05 GMT

Hi,

I'm not sure how to open the files, they are used for Splunk indexing and as such it probably isn't wise to edit the file/archive.

The following Splunk documentation mentions some commands which may be of use... HOWEVER YOU SHOULD TAKE NOTE OF THE WARNING... "Caution: Do not use these commands without consulting Splunk Support first." which is noted at the beginning of the text.

If you are looking to clean event data out of the index you could use the CLI clean command detailed here, again take note... once the event data has been removed you can not restore unless you have the original stored.

Regards,

MHibbin

Re: How to open the .tsidx file

dwaddle — Wed, 28 Dec 2011 18:08:41 GMT

Yes, these are Splunk's internal data format. Trying to open/edit them is very unwise.

Re: How to open the .tsidx file

muthukrishnan — Fri, 30 Dec 2011 07:22:19 GMT

Thanks MHibbin

Re: How to open the .tsidx file

MHibbin — Fri, 30 Dec 2011 11:43:10 GMT

If this helped answer you question, can you please mark the answer as accepted.

Re: How to open the .tsidx file

piebob — Thu, 25 Jul 2013 19:18:35 GMT

you can't open the files yourself, but you can use the tsidxprobe tool to have Splunk review them for you. check out:
http://docs.splunk.com/Documentation/Splunk/5.0.3/Troubleshooting/CommandlinetoolsforusewithSupport#tsidxprobe

for more info.