Deployment Architecture

$_Index_name Variable Need To Know How To Setup Correctly

gregbaskin
Explorer

I'm working on trying to figure out how to get the index name to show up correctly instead of placing the files in a folder named '$_index_name' on my backup folder on the indexer.

On the Cluster Master under $Splunk_Home/etc/master-apps/local/indexes.conf I have the following:

[default]
homePath = volume:primary/$_index_name/db --works correctly with variable
coldPath = volume:cold/$_index_name/db --works correctly with variable
coldToFrozenDir = /'foldername'/frozen/$_index_name --DOES NOT WORK CORRECTLY -'foldername' is irrelevant here and just a name of a folder.

Now, on the Indexer, where I want the data to go is to /'foldername'/frozen/

It's getting there on the Indexer however, it's coming in as /'foldername'/frozen/$_index_name/db

I'm running into the issue that this '$_index_name' is not translating to the index name and has created a folder named '$_index_name' instead of the actual index name.

Looking for a little guidance and solution to this challenge.

  1. Should I NOT use the environment variable and use only the absolute path on the 'coldToFrozenDir'?
  2. This is only on 1 indexer which I want to roll down to about 9 more so I'm looking for the best practice.
  3. I've looked here before posting this question: https://answers.splunk.com/answers/108178/index-name-variable-to-use-in-all-index-paths.html

Any insight will be helpful moving forward.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

$_index_name is not an environment variable. It's a Splunk shortcut available only for the hotPath, coldPath, and summaryHomePath attributes.

---
If this reply helps you, Karma would be appreciated.

gregbaskin
Explorer

Ok, thanks. Is there a better way to set this up where it creates the 'index name' instead of the folder like it is doing with the databases under that folder?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Copy-and-paste the index name from the stanza to the attribute.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...

New! Splunk Observability Search Enhancements for Splunk APM Services/Traces and ...

Regardless of where you are in Splunk Observability, you can search for relevant APM targets including service ...

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...