All Apps and Add-ons

Index is showing 0 data.

rajuljain2605
Explorer

I had created one VM (EC2 in aws, centos) and attached splunk ebs volume to it, mounted on /opt. On this Server, Splunk is running well but indexes are showing 0 data in splunk web. Though I can see data at $SPLUNK_DB, for all of my application indexes

indexes.conf having below conf

[prod-abc]
homePath               = $SPLUNK_DB/prod-abc/db
coldPath               = $SPLUNK_DB/prod-abc/colddb
coldToFrozenDir        = $SPLUNK_DB/prod-abc/frozendb
thawedPath             = $SPLUNK_DB/prod-abc/thaweddb
frozenTimePeriodInSecs = 63072000
maxDataSize            = auto

#If I create new index test and give below setting, change the path to absolute. It populate data in index:
[prod-test]
homePath               = /opt/splunk/volr/splunk/prod-abc/db
coldPath               = /opt/splunk/volr/splunk//prod-abc/colddb
coldToFrozenDir        = /opt/splunk/volr/splunk//prod-abc/frozendb
thawedPath             = /opt/splunk/volr/splunk//prod-abc/thaweddb
frozenTimePeriodInSecs = 63072000
maxDataSize            = auto

my splunk-launch.conf looks so-

# Where splunk is installed.
SPLUNK_HOME=/opt/splunk

# Location where we want to store the indexed data.
SPLUNK_DB=/volr/splunk

# Splunkd daemon name
SPLUNK_SERVER_NAME=splunkd

# Splunkweb daemon name
SPLUNK_WEB_NAME=splunkweb
0 Karma

jet1276
Path Finder

Hi @rajuljain2605

The Path you have mentioned for $SPLUNK_DB seems different. You should check that.

And also I'll suggest to mention full path in defining index instead of mentioning $SPLUNK_DB.

0 Karma

rajuljain2605
Explorer

Path=$SPLUNK_DB worked fine in our splunk, it is not working when I want to restore data from the snapshot of same server

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The path settings for the prod-test and prod-abc indexes are very different. Which is correct? Is your Splunk data in /opt/splunk/volr/splunk or /volr/splunk?

---
If this reply helps you, Karma would be appreciated.
0 Karma

rajuljain2605
Explorer

I have define the symlink to /opt/splunk/volr->/volr

0 Karma

rajuljain2605
Explorer

my splunk data is in /volr/splunk, I saw in splunk-launch.conf

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...