Deployment Architecture

Are double quotes acceptable to use for wrapping values in my conf files?

jbsplunk
Splunk Employee
Splunk Employee

For instance, if I try this in my distsearch.conf, it doesn't work:

[searchhead:SearchHead01-root]
mounted_bundles = true
bundles_location = "/opt/splunk/SH_bundles"

Will this work? Am I doing something wrong? I can't seem to make this work. Splunk complains that this isn't a directory:

4-07-2011 12:45:19.343 -0700 ERROR StreamedSearch - Bundle mounting: bundle location must be a directory, distsearch.conf stanza=searchhead:SearchHead01-root, bundles_location="/opt/splunk/SH_bundles", search head server_name=SearchHead01-root

1 Solution

Masa
Splunk Employee
Splunk Employee

No, I tried the exact same configuration, and got the same error.

Remove the double quotes. Then, it should work. This is not a script variable. The distsearch.conf does not like double quotes.

View solution in original post

Masa
Splunk Employee
Splunk Employee

No, I tried the exact same configuration, and got the same error.

Remove the double quotes. Then, it should work. This is not a script variable. The distsearch.conf does not like double quotes.

Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...