- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello
I have an API integration with my HF that gest data and then the HF forwards that data to the indexers. I need to declare an index for this data on the HF but the path isnt the same as it is when it gets to the indexer because the HF storage isnt mounted the same.
Basically:
This is what the Indexer indexes.conf looks like:
[index_name]
coldPath = volume:cold/index_name/colddb
homePath = volume:primary/index_name/db
thawedPath = $SPLUNK_DB/index_name/thaweddb
What I need to add to the HF would look like this:
[index_name]
coldPath = $SPLUNK_DB/index_name/colddb
homePath = $SPLUNK_DB/index_name/db
thawedPath = $SPLUNK_DB/index_name/thaweddb
Since the HF isnt indexing data does it matter if I create the index on the HF like this even though thats not what the indexer indexes.conf look like?
The reason I have to add the index is for the Dell EMC Isilon Add-on for Splunk Enterprise app, you have to declare the index in the setup of the addon.
Thanks!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The HF only needs index names to satisfy the UI. Give it the same indexes.conf as is on the indexers.
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
the path dont matter (only the index name is sent over the wire) but it need to be defined and the dir writable by splunk
If you are using a common app with volume primary, then one solution is to :
- have a indexes app that ref the volume and is used everywhere (indexer, sh, hf)
- have a indexer volume app that have the path on indexer and a volume limit if applicable (so you deploy it only on indexer)
- have a search volume app (deployed everywhere except on idx) , that define the same volume put point to $SPLUNK_DB
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The HF only needs index names to satisfy the UI. Give it the same indexes.conf as is on the indexers.
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What Im saying is that if I do that wont it throw errors since:
volume:primary
doesnt exist?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
As @richgalloway @said, you don’t need those index definition on HF unless you are configuring those with GUI. An in those cases only thing what really matter is index names. If you are managing HF configuration by files and/or DS then there is no need to even keep any additional index definitions.
r. Ismo