Deployment Architecture

Are double quotes acceptable to use for wrapping values in my conf files?

jbsplunk
Splunk Employee
Splunk Employee

For instance, if I try this in my distsearch.conf, it doesn't work:

[searchhead:SearchHead01-root]
mounted_bundles = true
bundles_location = "/opt/splunk/SH_bundles"

Will this work? Am I doing something wrong? I can't seem to make this work. Splunk complains that this isn't a directory:

4-07-2011 12:45:19.343 -0700 ERROR StreamedSearch - Bundle mounting: bundle location must be a directory, distsearch.conf stanza=searchhead:SearchHead01-root, bundles_location="/opt/splunk/SH_bundles", search head server_name=SearchHead01-root

1 Solution

Masa
Splunk Employee
Splunk Employee

No, I tried the exact same configuration, and got the same error.

Remove the double quotes. Then, it should work. This is not a script variable. The distsearch.conf does not like double quotes.

View solution in original post

Masa
Splunk Employee
Splunk Employee

No, I tried the exact same configuration, and got the same error.

Remove the double quotes. Then, it should work. This is not a script variable. The distsearch.conf does not like double quotes.

Get Updates on the Splunk Community!

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...

Announcing the Migration of the Splunk Add-on for Microsoft Azure Inputs to ...

Announcing the Migration of the Splunk Add-on for Microsoft Azure Inputs to Officially Supported Splunk ...