Getting Data In

Is thawedPath in indexes.conf recommended?

sympatiko
Communicator

Hi Splunkers,

I just want to ask if it is required in indexes.conf to specify the thawedPath?

Thanks,
Eddel

Tags (2)
0 Karma
1 Solution

Sourabhv05
Communicator

yes its mandatory.

View solution in original post

0 Karma

Sourabhv05
Communicator

yes its mandatory.

0 Karma

sympatiko
Communicator

Thank u bro!

Can you give some explanation. Explanation based on experience not just giving the splunk doc links 😃 .

0 Karma

ppablo
Retired

Hi @sympatiko

I tried searching through all Splunk Answers and couldn't find a detailed explanation for this. I know you didn't want to just hear something from the documentation, but it does explicitly say "Required. Splunk will not start if an index lacks a valid thawedPath." So it doesn't seem like there's any ifs ands or buts with this setting. If I hear a more in depth explanation as to why it's required, I'll post an update here.

0 Karma

sympatiko
Communicator

Thanks for the info bro! I'm still exploring splunk. Have a great day!

0 Karma

lmyrefelt
Builder

set it and forget it 😉

0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...