Cleaning Indexes not working

[johnness]

Hi SplunkBase
Trying out the free version (4.2.4) on my Windows 7 64bit client and as you can guess, hit an index limit (500mb). I wanted to run the clean commnand but get the following message window when running the following command(s):

C:\Program Files\Splunk\bin>.\splunk stop << works !
C:\Program Files\Splunk\bin>.\splunk help clean << popup

Popup Window:
Title: C:\Program Files\Splunk\bin\splunk.exe

Could not look up HOMEPATH variable. Auth tokens cannot be cached.

Any help appreciated.

Regads, John

[johnness]

on the elevated Command Prompt enter

SET HOMEPATH=C:\Temp

And because you'll get an error message about the missing HOMEDRIVE just

SET HOMEDRIVE=C:

And all is well.

[johnness]

Hi MHibbin

Your answer was only part of the solution. I still can't get used to the fact that starting a command prompt as "Administrator" is not the same as opening a Command Prompt with an administrative account via:

runas /user:domain\user * cmd

Your answer solved the popup problem but not the HOMEPATH issue. Following is the Command Prompt output after using splunk help clean

C:\Program Files\Splunk\bin>splunk help clean

Could not look up HOMEPATH variable. Auth tokens cannot be cached.

An error occurred: Could not determine user's home directory because HOMEPATH
shell variable is not set.

There are various homepath variables defined in the C:\Program Files\Splunk\etc\system\default\indexes.conf file, but what to change?
I currently have no indexes.conf file in the C:\Program Files\Splunk\etc\system\local directory, because I am still using the basic installation.

And I have no Homepath in my environment variables.

Thanks for the first hint. Looking forward to the complete solution.

Regards, John

[MHibbin · Accepted solution]

I don't think you need the ".\" I normally just cd to the bin directory, as you have done, and then run a command like...

C:\>Program Files\Splunk\bin>splunk.exe clean eventdata -index <index name>

So you are looking for

C:\>Program Files\Splunk\bin>splunk.exe help clean

To stop the command opening in a popup, and I think this will help with the HomePath issue, as I assume you installed Splunk with admin priviledges, you should also run the CMD prompt as Administrator...

"Start" >> Type CMD in search bar >> Right-click CMD >> "Run as administrator"

You can check your HOMEPATH using the following command (not to be confused with the homePath variable used in Splunk)...

>SET HOMEPATH

Mine on my dev laptop is...

HOMEPATH=\Users\Matt

Hope this helps

[MHibbin]

I changed the formatting, and added the part about HOMEPATH, I too had a similar issue like this previously (and had forgotten about about the SET HOMEPATH part, however I had edited my answer before seeing your answer :0) ).

[samiulamin123]

Hi MHibbin,

Can you please explain the homepath issue? I did not see any mention of it in splunk doc regarding cleaning and deleting index.

Thanks and regards,

Samiul

[johnness]

Puzzled. Did your answer change? Ok you get full marks.

I set HOMEPATH to C:\Temp and the then missing HOMEDRIVE to C: which seems to have solved my issue.

[johnness]

Hi MHibbin

Your answer was part of the solution. I still can't get used to the fact that starting a prompt as "Administrator" is not the same as opening a Command Prompt with an administrative account via:

runas /user:domain\user * cmd

Your answer solved the popup problem but not the HOMEPATH issue. Following is the output after using splunk help clean

C:\Program Files\Splunk\bin>splunk help clean

Could not look up HOMEPATH variable. Auth tokens cannot be cached.

An error occurred: Could not determine user's home directory because HOMEPATH shell variable is not set.