Getting Data In

Does it matter if an index path is the same on an HF as it is in the indexer?

tkw03
Communicator

Hello

I have an API integration with my HF that gest data and then the HF forwards that data to the indexers. I need to declare an index for this data on the HF but the path isnt the same as it is when it gets to the indexer because the HF storage isnt mounted the same.

Basically:

This is what the Indexer indexes.conf looks like:

 

 

 

[index_name]
coldPath = volume:cold/index_name/colddb
homePath = volume:primary/index_name/db
thawedPath = $SPLUNK_DB/index_name/thaweddb

 

 

 

 

What I need to add to the HF would look like this:

 

 

 

[index_name]
coldPath = $SPLUNK_DB/index_name/colddb
homePath = $SPLUNK_DB/index_name/db
thawedPath = $SPLUNK_DB/index_name/thaweddb

 

 

 

 

Since the HF isnt indexing data does it matter if I create the index on the HF like this even though thats not what the indexer indexes.conf look like? 

 

The reason I have to add the index is for the Dell EMC Isilon Add-on for Splunk Enterprise app, you have to declare the index in the setup of the addon.


Thanks!

 

 

 

Labels (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The HF only needs index names to satisfy the UI.  Give it the same indexes.conf as is on the indexers. 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

maraman_splunk
Splunk Employee
Splunk Employee

the path dont matter (only the index name is sent over the wire) but it need to be defined and the dir writable by splunk

If you are using a common app with volume primary, then one solution is to :

- have a indexes app that ref the volume and is used everywhere (indexer, sh, hf)

- have a indexer volume app that have the path on indexer and a volume limit if applicable (so you deploy it only on indexer)

- have a search volume app (deployed everywhere except on idx) , that define the same volume put point to $SPLUNK_DB

 

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The HF only needs index names to satisfy the UI.  Give it the same indexes.conf as is on the indexers. 

---
If this reply helps you, Karma would be appreciated.
0 Karma

tkw03
Communicator

What Im saying is that if I do that wont it throw errors since:

 volume:primary

 doesnt exist? 

0 Karma

isoutamo
SplunkTrust
SplunkTrust

As @richgalloway @said, you don’t need those index definition on HF unless you are configuring those with GUI. An in those cases only thing what really matter is index names. If you are managing HF configuration by files and/or DS then there is no need to even keep any additional index definitions.

r. Ismo

Get Updates on the Splunk Community!

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

What's New in Splunk Observability Cloud and Splunk AppDynamics - May 2025

This month, we’re delivering several new innovations in Splunk Observability Cloud and Splunk AppDynamics ...