Error message is displayed when I rebuild archive data.

[yutaka1005]

When I rebuild archive data, ERROR message is displayed like below.

ERROR ProcessTracker - (subchild_43__RollFixMetadata) IndexConfig - Asked to check if idx= is an index with a remote storage, but that index does not exist on the system or is disabled

However, the rebuilt data will be displayed normally as a result when I search it.

What is this message?
My index data is not under the default "SPLUNK_HOME/var/lib/splunk/", but it is placed under "/data" which is another partition.
Is it related to this "ERROR"?

[yutaka1005 · Accepted solution]

I think this may be bug of Splunk ver 6.6.4.

Because, just install Splunk 6.6.4,
The same error message appeared even if following steps were taken.

1. Upload data that will be archived soon to index "test".

2. Restart Splunk and archive the data.

3.Copy the archive data to $SPLUNK_DB/test/thaweddb and execute the following command.

/opt/splunk/bin/splunk rebuild db_1424259300_1424259300_1/

Then the following error appears.

ERROR ProcessTracker - (subchild_43__RollFixMetadata) IndexConfig - Asked to 
check if idx= is an index with a remote storage, but that index does not exist on the 
system or is disabled

indexes.conf

[test]
coldPath = $SPLUNK_DB/test/colddb
enableDataIntegrityControl = 0
enableTsidxReduction = 0
homePath = $SPLUNK_DB/test/db
maxTotalDataSizeMB = 512000
thawedPath = $SPLUNK_DB/test/thaweddb
bucketRebuildMemoryHint = 0
coldToFrozenDir = /opt/splunk/var/lib/splunk/frozen
compressRawdata = 1
enableOnlineBucketRepair = 1
minHotIdleSecsBeforeForceRoll = 0
rtRouterQueueSize =
rtRouterThreads =
suspendHotRollByDeleteQuery = 0
syncMeta = 1
frozenTimePeriodInSecs = 10000

[yutaka1005]

splunk support said this message can be ignored.

[claudio_manig]

THANK YOU SIR

[Elsurion]

Hi Yutaka

Have you modified your SPUNK_DB Variable in the ~/etc/splunk-launch.conf Conffile?
Normaly it is not set, so the default path is taken.

# By default, Splunk stores its indexes under SPLUNK_HOME in the
# var/lib/splunk subdirectory.  This can be overridden
# here:
#
# SPLUNK_DB=/home/build/build-home/ember/var/lib/splunk
SPLUNK_DB=/some/path

[yutaka1005]

Thank you for answer Elsurion!

Yes I haven't modified "SPLUNK_DB" variable.
But I don't use $SPLUNK_DB$ in indexes.conf.

I configured like below in indexes.conf.

coldPath = /data/lndexes/<index_name>/colddb
homePath = /data/lndexes/<index_name>/db
thawedPath =/data/lndexes/<index_name>/thaweddb
coldToFrozenDir =/data/Frozen/<index_name>

[Elsurion]

one other thing i have done on an installation is a symbolic link from the var/lib/splunk to the index folder. Might help.
link between ~/var/lib/splunk and /data/Indexes

[mayurr98]

does that index exist on your system where you are archiving the data?

[yutaka1005]

Index folder including "thawed_db" and frozen path storing archive data is under "/data" which is a different partition, not "SPLUNK_HOME/var/lib/splunk/".

The index that used to rebuild the archive data is under "/data" too.

[mayurr98]

not the index folder i am talking about the index that you configure in local/indexes.conf

[yutaka1005]

Yeah! It certainly exists.

Because I can specify the index and retrieve the rebuilt data on SPL like below.
search index=... |