topic Re: index_name variable to use in all index paths in Splunk Search

index_name variable to use in all index paths

ashleyherbert — Mon, 28 Oct 2013 06:19:34 GMT

I'm looking for a variable that can be used to replace the index name for the following configs in the indexes.conf file:

homePath

coldPath

thawedPath

I'm using volumes for my index paths, and in V6 I have found a variable called $_index_name which replaces the home & cold paths with the index name. This is how my global config now looks:

coldPath = volume:cold/$_index_name/colddb

homePath = volume:hot/$_index_name/db

This successfully replaces the index name, however, if I use this variable in the thawedPath, it won't resolve the variable and instead tries to create a folder called $_index_name, which fails as the different indexes try to use the same location.

I'm trying to do this to allow me to standardise the index stanza's, as we have quite a lot of them.

Does anyone know of a better way to do this?

Thanks,

Ash

Re: index_name variable to use in all index paths

_d_ — Mon, 28 Oct 2013 12:45:05 GMT

Note that thawedPath needs an absolute path that does NOT contain a volume reference.

Re: index_name variable to use in all index paths

sowings — Mon, 28 Oct 2013 13:55:42 GMT

I'm guessing that thawedPath is a bit of the "odd one out" and may not play nice with $_index_name, but I don't know that for certain.

Re: index_name variable to use in all index paths

ashleyherbert — Mon, 28 Sep 2020 15:06:49 GMT

Thanks, yeah I'm aware that the thawedPath can't contain a volume reference. My issue is the variable name rather than the volume. I find it very strange that the $SPLUNK_DB variable resolves fine in the thawedPath, but not the $_index_name

Re: index_name variable to use in all index paths

cramasta — Fri, 06 Dec 2013 16:08:26 GMT

ever hear anything more about this?

Re: index_name variable to use in all index paths

spavin — Tue, 29 Sep 2020 23:29:56 GMT

I have the same thing happening with my thawed path - it is configured as:

[my_index]
homePath = volume_hot:/$_index_name/db
coldPath = volume_cold:/$_index_name/colddb
thawedPath = $SPLUNK_DB/$_index_name/thaweddb
...

The hot and cold work as intended, however the thawed db ends up in: /opt/splunk/var/lib/splunk/$_index_name/thaweddb

I checked the docs for indexes.conf, and while it doesn't explicitly tell you to not use $_index_name for thawedDB path, it doesn't use it in the example (but it does for homePath/ coldPath). It says that the thawedPath should contain an absolute path that contains the thawed (resurrected) databases for the index.

Of note, it mentions:

We strongly recommend that you avoid the use of environment variables in index paths, 
aside from the possible exception of SPLUNK_DB.  See homePath  for the complete rationale.

However, that warning is also mentioned for homePath and cold Path.

For now, I'll stick to writing out the index name in the path.