Getting Data In

Does it matter if an index path is the same on an HF as it is in the indexer?

tkw03
Communicator

Hello

I have an API integration with my HF that gest data and then the HF forwards that data to the indexers. I need to declare an index for this data on the HF but the path isnt the same as it is when it gets to the indexer because the HF storage isnt mounted the same.

Basically:

This is what the Indexer indexes.conf looks like:

 

 

 

[index_name]
coldPath = volume:cold/index_name/colddb
homePath = volume:primary/index_name/db
thawedPath = $SPLUNK_DB/index_name/thaweddb

 

 

 

 

What I need to add to the HF would look like this:

 

 

 

[index_name]
coldPath = $SPLUNK_DB/index_name/colddb
homePath = $SPLUNK_DB/index_name/db
thawedPath = $SPLUNK_DB/index_name/thaweddb

 

 

 

 

Since the HF isnt indexing data does it matter if I create the index on the HF like this even though thats not what the indexer indexes.conf look like? 

 

The reason I have to add the index is for the Dell EMC Isilon Add-on for Splunk Enterprise app, you have to declare the index in the setup of the addon.


Thanks!

 

 

 

Labels (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The HF only needs index names to satisfy the UI.  Give it the same indexes.conf as is on the indexers. 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

maraman_splunk
Splunk Employee
Splunk Employee

the path dont matter (only the index name is sent over the wire) but it need to be defined and the dir writable by splunk

If you are using a common app with volume primary, then one solution is to :

- have a indexes app that ref the volume and is used everywhere (indexer, sh, hf)

- have a indexer volume app that have the path on indexer and a volume limit if applicable (so you deploy it only on indexer)

- have a search volume app (deployed everywhere except on idx) , that define the same volume put point to $SPLUNK_DB

 

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The HF only needs index names to satisfy the UI.  Give it the same indexes.conf as is on the indexers. 

---
If this reply helps you, Karma would be appreciated.
0 Karma

tkw03
Communicator

What Im saying is that if I do that wont it throw errors since:

 volume:primary

 doesnt exist? 

0 Karma

isoutamo
SplunkTrust
SplunkTrust

As @richgalloway @said, you don’t need those index definition on HF unless you are configuring those with GUI. An in those cases only thing what really matter is index names. If you are managing HF configuration by files and/or DS then there is no need to even keep any additional index definitions.

r. Ismo

Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...