Getting Data In

Does it matter if an index path is the same on an HF as it is in the indexer?

tkw03
Communicator

Hello

I have an API integration with my HF that gest data and then the HF forwards that data to the indexers. I need to declare an index for this data on the HF but the path isnt the same as it is when it gets to the indexer because the HF storage isnt mounted the same.

Basically:

This is what the Indexer indexes.conf looks like:

 

 

 

[index_name]
coldPath = volume:cold/index_name/colddb
homePath = volume:primary/index_name/db
thawedPath = $SPLUNK_DB/index_name/thaweddb

 

 

 

 

What I need to add to the HF would look like this:

 

 

 

[index_name]
coldPath = $SPLUNK_DB/index_name/colddb
homePath = $SPLUNK_DB/index_name/db
thawedPath = $SPLUNK_DB/index_name/thaweddb

 

 

 

 

Since the HF isnt indexing data does it matter if I create the index on the HF like this even though thats not what the indexer indexes.conf look like? 

 

The reason I have to add the index is for the Dell EMC Isilon Add-on for Splunk Enterprise app, you have to declare the index in the setup of the addon.


Thanks!

 

 

 

Labels (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The HF only needs index names to satisfy the UI.  Give it the same indexes.conf as is on the indexers. 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

maraman_splunk
Splunk Employee
Splunk Employee

the path dont matter (only the index name is sent over the wire) but it need to be defined and the dir writable by splunk

If you are using a common app with volume primary, then one solution is to :

- have a indexes app that ref the volume and is used everywhere (indexer, sh, hf)

- have a indexer volume app that have the path on indexer and a volume limit if applicable (so you deploy it only on indexer)

- have a search volume app (deployed everywhere except on idx) , that define the same volume put point to $SPLUNK_DB

 

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The HF only needs index names to satisfy the UI.  Give it the same indexes.conf as is on the indexers. 

---
If this reply helps you, Karma would be appreciated.
0 Karma

tkw03
Communicator

What Im saying is that if I do that wont it throw errors since:

 volume:primary

 doesnt exist? 

0 Karma

isoutamo
SplunkTrust
SplunkTrust

As @richgalloway @said, you don’t need those index definition on HF unless you are configuring those with GUI. An in those cases only thing what really matter is index names. If you are managing HF configuration by files and/or DS then there is no need to even keep any additional index definitions.

r. Ismo

Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...