Deployment Architecture

In trying to create coldToFrozenDir, has anyone seen the following "load IndexConfig" error?

sreejith2k2
Explorer

I am trying to create coldToFrozenDir on one of my network indexes. I am trying to do this in the Development environment before going to production environment.

[volume:frozen]
path = /opt/frozen/network

[network]
homePath = volume:primary/network/db
coldPath = volume:primary/network/colddb
thawedPath = $SPLUNK_DB/network/thaweddb
coldToFrozenDir = volume:frozen/network/frozendb
maxTotalDataSizeMB = 55000
frozenTimePeriodInSecs = 7776000

But, I am getting the following error —

Problem parsing indexes.conf: Cannot load IndexConfig: Cannot create index 'network':path of coldToFrozenDir must be absolute ('volume:frozen/network/frozendb')
Validating databases (splunkd validatedb) failed with code '1'. If you cannot resolve the issue(s) above after consulting documentation, please file a case online at   http://www.splunk.com/page/submit_issue

I've have even tried specifying path with no luck -

coldToFrozenDir = /opt/frozen/network

I am getting the same error. It's on the same file system

0 Karma

horsefez
Motivator

Does the splunk user has sufficient permissions to create a directory at that location?

0 Karma

sreejith2k2
Explorer

yes he has.. I have cross checked it.. Also I re-ran chown command as well.

0 Karma
Get Updates on the Splunk Community!

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer at Splunk .conf24 ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Combine Multiline Logs into a Single Event with SOCK: a Step-by-Step Guide for ...

Combine multiline logs into a single event with SOCK - a step-by-step guide for newbies Olga Malita The ...