Getting Data In

Problem parsing indexes.conf: Cannot load IndexConfig: ...

Robbie1194
Communicator

Hi guys,

I'm new to dealing with .conf files so I'm having a practice on my own home splunk instance. My goal is to try and create an index named "lapd" from indexes.conf and then upload a datafile to this index via inputs.conf

I've made an app named Dataload and I am storing all the config in the local folder of this app

my indexes.conf file is:

[volume:primary]
path = /Applications/Splunk/

[LAPD]
homePath = volume:primary/defaultdb/db
coldPath = volume:primary/defaultdb/colddb
thawedPath = $SPLUNK_DB/defaultdb/thaweddb

When I try and start splunk I get this error message:

Problem parsing indexes.conf: Cannot load IndexConfig: index=main Path=/Applications/Splunk/var/lib/splunk/defaultdb/db given as value of param=homePath collides with value of param2=homePath of index2=lapd.
Validating databases (splunkd validatedb) failed with code '1'. If you cannot resolve the issue(s) above after consulting documentation, please file a case online at http://www.splunk.com/page/submit_issue

Does anyone have any idea why this might be? Any help would be appreciated.

Thanks 🙂

0 Karma
1 Solution

bheemireddi
Communicator

You have used the path for the main (default) index for the LAPD index.

It should be like this
[LAPD]
homePath = volume:primary/LAPD/db
coldPath = volume:primary/LAPD/colddb
thawedPath = $SPLUNK_DB/LAPD/thaweddb

View solution in original post

bheemireddi
Communicator

You have used the path for the main (default) index for the LAPD index.

It should be like this
[LAPD]
homePath = volume:primary/LAPD/db
coldPath = volume:primary/LAPD/colddb
thawedPath = $SPLUNK_DB/LAPD/thaweddb

burwell
SplunkTrust
SplunkTrust

The interesting thing is that btool check does not detect this collision.

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

Exactly.
For completeness, this is the definition for the main index (from $SPLUNK_HOME/etc/system/default/indexes.conf)

[main]
homePath   = $SPLUNK_DB/defaultdb/db
coldPath   = $SPLUNK_DB/defaultdb/colddb
thawedPath = $SPLUNK_DB/defaultdb/thaweddb

Hence the path collision, since you cannot use the same path for two different indices.

Robbie1194
Communicator

Thanks guys that was exactly it!

Got my inputs.conf working too!

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...