Archive
Highlighted

Where is tsidx created?

Splunk Employee
Splunk Employee

If I run :

1.index=* | fields action | tscollect namespace=myaction ...(creates tsidx file)

2.The myaction namespace will be created under $SPLUNK
HOME/var/lib/splunk/tsidxstats/myaction

3.| tstats count from myaction groupby action ...(read tsidx file)

However, if I don't use a namespace value where does the tsidx get created?

Tags (2)
Highlighted

Re: Where is tsidx created?

Splunk Employee
Splunk Employee

Found it looks like it will be created under :

/opt/home/rick/splunk/var/run/splunk/dispatch/1380485760.325/tsidxstats

View solution in original post