Not able to start Splunk on Windows when coldpath is set to a CIFS share

[zliu]

We have configured Splunk 4.2.2 running on Windows Server 2008 R2 with a coldPath pointing to a volume ("cold") hosted on a CIFS network drive.

Contents of indexes.conf :
#Volume Definition

[volume:cold]
path = \\sjc-vault\SplunkArchive\splunk01
maxVolumeDataSizeMB = 1000000

################################################################################
# index definitions
################################################################################

[main]
coldPath = volume:cold\defaultdb\colddb
[history]
coldPath = volume:cold\historydb\colddb
[summary]
coldPath = volume:cold\summarydb\colddb
[_internal]
coldPath = volume:cold\_internaldb\colddb
[_audit]
coldPath = volume:cold\audit\colddb
[_thefishbucket]
coldPath = volume:cold\fishbucket\colddb
[_blocksignature]
coldPath = volume:cold\blockSignature\colddb 

However, we get errors on startup for every index with a cold path set to the remote network drive:

In handler 'indexes': Unable to load index configuration: In index '_internal': Failed to create directory '\\sjc-vault\SplunkArchive\splunk02\_internaldb\colddb' (Cannot create a file when that file already exists. 

We are using a domain account to run splunkd. This account has full rights to the shares and folders, therefore this should not be a permission issue.

Any advice is appreciated!

[ekost · Accepted solution]

CIFS is not a currently supported file system for Splunk indexing. Please check here for updates as new version of Splunk are made available: System Requirements:Supported File Systems

[LCM]

Curious about the msg itself: Does '\sjc-vault\SplunkArchive\splunk02_internaldb\colddb' already exist? (if yes, can you delete that and start splunk up again)