Last Chance Index setup issues

lavster — Wed, 30 Sep 2020 02:20:22 GMT

hello, we are trying to configure a lastchanceindex to capture events being sent to a non-existing index, however it doesnt seem to be working. I've added to the indexes.conf "lastChanceIndex = test_collect_std" but we still get the error message

Search peer indexer-6 has the following message: Received event for unconfigured/disabled/deleted index=fake_index with source="source::D:\tmp\ExampleLog.log" host="host::MACHINE" sourcetype="sourcetype::fake_sourcetype". So far received events from 1 missing index(es).

So the re-route doesnt seem to be doing what it should, there is very little documentation on this. Has anyone successfully got this to work?

For info we are running 7.3.0

Re: Last Chance Index setup issues

adonio — Wed, 25 Sep 2019 16:33:17 GMT

can you share your indexes.conf?
this configuration should be under the [default] stanza ... so should look something like this:

indexes.conf:

[default]
lastChanceIndex = main

[index1]
homePath   = $SPLUNK_DB/index1/db
coldPath   = $SPLUNK_DB/index1/colddb
thawedPath = $SPLUNK_DB/index1/thaweddb
maxDataSize = 10000
maxHotBuckets = 10

[index2]
homePath   = $SPLUNK_DB/index2/db
coldPath   = $SPLUNK_DB/index2/colddb
thawedPath = $SPLUNK_DB/index2/thaweddb
maxDataSize = 10000
maxHotBuckets = 10

.....

topic Re: Last Chance Index setup issues in Splunk Search

Last Chance Index setup issues

Re: Last Chance Index setup issues