$_Index_name Variable Need To Know How To Setup Correctly

[gregbaskin]

I'm working on trying to figure out how to get the index name to show up correctly instead of placing the files in a folder named '$_index_name' on my backup folder on the indexer.

On the Cluster Master under $Splunk_Home/etc/master-apps/local/indexes.conf I have the following:

[default]
homePath = volume:primary/$_index_name/db --works correctly with variable
coldPath = volume:cold/$_index_name/db --works correctly with variable
coldToFrozenDir = /'foldername'/frozen/$_index_name --DOES NOT WORK CORRECTLY -'foldername' is irrelevant here and just a name of a folder.

Now, on the Indexer, where I want the data to go is to /'foldername'/frozen/

It's getting there on the Indexer however, it's coming in as /'foldername'/frozen/$_index_name/db

I'm running into the issue that this '$_index_name' is not translating to the index name and has created a folder named '$_index_name' instead of the actual index name.

Looking for a little guidance and solution to this challenge.

1. Should I NOT use the environment variable and use only the absolute path on the 'coldToFrozenDir'?
2. This is only on 1 indexer which I want to roll down to about 9 more so I'm looking for the best practice.
3. I've looked here before posting this question: https://answers.splunk.com/answers/108178/index-name-variable-to-use-in-all-index-paths.html

Any insight will be helpful moving forward.

[richgalloway]

$_index_name is not an environment variable. It's a Splunk shortcut available only for the hotPath, coldPath, and summaryHomePath attributes.

[gregbaskin]

Ok, thanks. Is there a better way to set this up where it creates the 'index name' instead of the folder like it is doing with the databases under that folder?

[richgalloway]

Copy-and-paste the index name from the stanza to the attribute.