Deployment Architecture

where these custom indexes are getting stored on indexer server?

vowner
Engager

I have created indexes using splunk web. can anyone tell where these custom indexes are getting stored on indexer server?

Tags (1)
0 Karma

renjith_nair
Legend

Hi @vowner,

The index data files are stored under your SPLUNK_DIR/var/lib/splunk

Index configuration files are stored based on the app context. If you were creating it from Search app, then it should be in etc/apps/search/local/indexes.conf

Another easiest way to find all information is running the btool

splunk cmd btool indexes list --debug
---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

renjith_nair
Legend

Hi @vowner,
Did this work for you?

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...