Getting Data In

When creating a diag, splunk complains about splunklogger index not having paths for home/cold/thawedPath

Genti
Splunk Employee
Splunk Employee

I was told from support to run ./splunk diag and i receive the following:

./splunk diag
Ensuring clean temp dir...
Selected diag name of: diag-beefysup01-2011-04-12
Starting splunk diag...
The index splunklogger does not have a value set for homePath, this is unusual.
The index splunklogger does not have a value set for coldPath, this is unusual.
The index splunklogger does not have a value set for thawedPath, this is unusual.
Copying Splunk configuration files...
Copying Splunk log files...
Copying index worddata, and bucket info files...
The index splunklogger does not have a value set for homePath, this is unusual.
The index splunklogger does not have a value set for coldPath, this is unusual.
The index splunklogger does not have a value set for thawedPath, this is unusual.
Copying Splunk log files in the dispatch dir...
Creating archive file...
Cleaning up...
Splunk diagnosis file created: /home/gzaimi/splunk418/diag-beefysup01-2011-04-12.tar.gz

Why is this happening, what does it mean?
.gz

Tags (2)
1 Solution

hexx
Splunk Employee
Splunk Employee

These errors are benign and are occurring because of an orphaned stanza for the legacy "splunklogger" index in $SPLUNK_HOME/etc/system/default/indexes.conf :

 # this index has been removed in the 4.1 series, but this stanza must be
 # preserved to avoid displaying errors for users that have tweaked the index's
 # size/etc parameters in local/indexes.conf.
 [splunklogger]
 disabled = true

The goal of this stanza is to disable the "splunklogger" index which has been deprecated for a while. Splunk diag is a little bit anal about index stanzas that fail to include non-optional parameters such as "homePath", "coldPath" or "thawedPath" which is why you are seeing this error.

The easiest way to suppress this error would be to modify the [splunklogger] stanza in $SPLUNK_HOME/etc/system/default/indexes.conf (or $SPLUNK_HOME/etc/system/local/indexes.conf if you want this to be upgrade-resilient) as follows :

 # this index has been removed in the 4.1 series, but this stanza must be
 # preserved to avoid displaying errors for users that have tweaked the index's
 # size/etc parameters in local/indexes.conf.
 [splunklogger]
 disabled = true
 homePath = $SPLUNK_DB/splunklogger/db
 coldPath = $SPLUNK_DB/splunklogger/colddb
 thawedPath = $SPLUNK_DB/splunklogger/thaweddb

In all likelihood, this minor cosmetic error will be fixed in a future release.

View solution in original post

hexx
Splunk Employee
Splunk Employee

These errors are benign and are occurring because of an orphaned stanza for the legacy "splunklogger" index in $SPLUNK_HOME/etc/system/default/indexes.conf :

 # this index has been removed in the 4.1 series, but this stanza must be
 # preserved to avoid displaying errors for users that have tweaked the index's
 # size/etc parameters in local/indexes.conf.
 [splunklogger]
 disabled = true

The goal of this stanza is to disable the "splunklogger" index which has been deprecated for a while. Splunk diag is a little bit anal about index stanzas that fail to include non-optional parameters such as "homePath", "coldPath" or "thawedPath" which is why you are seeing this error.

The easiest way to suppress this error would be to modify the [splunklogger] stanza in $SPLUNK_HOME/etc/system/default/indexes.conf (or $SPLUNK_HOME/etc/system/local/indexes.conf if you want this to be upgrade-resilient) as follows :

 # this index has been removed in the 4.1 series, but this stanza must be
 # preserved to avoid displaying errors for users that have tweaked the index's
 # size/etc parameters in local/indexes.conf.
 [splunklogger]
 disabled = true
 homePath = $SPLUNK_DB/splunklogger/db
 coldPath = $SPLUNK_DB/splunklogger/colddb
 thawedPath = $SPLUNK_DB/splunklogger/thaweddb

In all likelihood, this minor cosmetic error will be fixed in a future release.

Ellen
Splunk Employee
Splunk Employee

As of 4.1.7 and up, $SPLUNK_HOME/etc/system/default/indexes.conf now defaults to disable the splunklogger index as:

[splunklogger]
disabled = true

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...