Getting Data In

After creating an index for the Search app, why is my indexes.conf file missing from C:\Program Files\Splunk\etc\apps\search?

New Member

Hello,

I have trial version of Splunk Enterprise with me. I created an index for the search and reporting app, but why I do not find indexes.conf at the location below?

C:\Program Files\Splunk\etc\apps\search\

Jesmi

0 Karma

Splunk Employee
Splunk Employee

Take a look in the GUI. Settings > Indexes. Find the index you created.

It will tell you which App context it was created in in the "App" column.

Your indexes.conf will be located in Splunk\etc\apps\"app name"\local\indexes.conf

0 Karma

Super Champion

Did you look in Splunk\etc\apps\search\local ?

0 Karma

New Member

The file Local is missing too.

0 Karma

Super Champion

Not a file, a folder. When you make changes in Splunk they are put in the app\local folder. If you don't have a search\app\local folder, then the index was not created specifically for the search app.
From the UI, select Settings>Indexes, you should see a list with your index included. Which App is listed for that index?

0 Karma

Ultra Champion

Anything under Splunk\etc\system\local?

0 Karma