Dashboards & Visualizations

Has the "main" index been replaced by "default" since Splunk 6.3?

jackpal
Path Finder

It seems that since my upgrade to Splunk 6.3 from 6.1, a new index called "default" has appeared. Also, since then, my license usage has increased. I am not sure if they are related.

0 Karma

dkeck
Influencer

Hi,

I can only speak for myself, but in 6.3.1 the main index is still present and there's no "default" index.

Maybe you installed an TA that created that index?

Kind regards

0 Karma

jackpal
Path Finder

Thanks, I did install the Unix add on and app. However my split license usage does not show main anymore. It only shows default , os and one other that I created. Definitely new behavior since my upgrade.

0 Karma

dkeck
Influencer

I have the Splunk_TA_nix as well, thats not it.

Try to have a look inside the indexes.conf. Maybe you can see something there about the main index. It should be in there.

SPLUNK_HOME/etc/system/default( or local)/indexes.conf

0 Karma

jackpal
Path Finder

main is still in there as a definition bu the path is: homePath = $SPLUNK_DB/defaultdb/db

Not really sure what it was called before or if it was always called this. I do know that main was always the "default" index

0 Karma

dkeck
Influencer

Thats mine, should be the default:

[main]
    homePath   = $SPLUNK_DB/defaultdb/db
    coldPath   = $SPLUNK_DB/defaultdb/colddb
    thawedPath = $SPLUNK_DB/defaultdb/thaweddb
    tstatsHomePath = volume:_splunk_summaries/defaultdb/datamodel_summary
    maxMemMB = 20
    maxConcurrentOptimizes = 6
    maxHotIdleSecs = 86400
    maxHotBuckets = 10
    maxDataSize = auto_high_volume
0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...