Getting Data In

After creating an index for the Search app, why is my indexes.conf file missing from C:\Program Files\Splunk\etc\apps\search?

jesmi_harindran
New Member

Hello,

I have trial version of Splunk Enterprise with me. I created an index for the search and reporting app, but why I do not find indexes.conf at the location below?

C:\Program Files\Splunk\etc\apps\search\

Jesmi

0 Karma

ktugwell_splunk
Splunk Employee
Splunk Employee

Take a look in the GUI. Settings > Indexes. Find the index you created.

It will tell you which App context it was created in in the "App" column.

Your indexes.conf will be located in Splunk\etc\apps\"app name"\local\indexes.conf

0 Karma

lukejadamec
Super Champion

Did you look in Splunk\etc\apps\search\local ?

0 Karma

jesmi_harindran
New Member

The file Local is missing too.

0 Karma

lukejadamec
Super Champion

Not a file, a folder. When you make changes in Splunk they are put in the app\local folder. If you don't have a search\app\local folder, then the index was not created specifically for the search app.
From the UI, select Settings>Indexes, you should see a list with your index included. Which App is listed for that index?

0 Karma

ddrillic
Ultra Champion

Anything under Splunk\etc\system\local?

0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...