Unable to add CIFS share as frozen path

[matchpump]

I'm trying to create a new index and specify a CIFS share as "Frozen Path". But I got an error "Unable to load index configuration: In index 'index1': Failed to create directory '\192.168.110.140\archive\index1\' (指定されたパスは無効です。)
"指定されたパスは無効です。" is translated into "specified path is invalid"(This message seems generated from Windows OS because the locale setting of splunk is english on Japanese Windows OS).
I can access the path above from explorer, so I believe it's not a access privilege problem.
I also tested to add drive letter for the path( \192.168.110.140\archive\index1\ -> Y:).
This work fine. But I can't set the path to Y:xxx. I got the same error as above.

Any advise or thoughts is welcome!

Thanks.

[schose]

if Splunk is running as system user the share and filesystem have to be writeable for the account "domain\computername$".

For troubleshooting select a useraccount which is local admin and let splunk run in this account. Try to create a file with this account.

Otherwise use psexec -s from sysinternals to test Share and filesystem right as system user.

Regards,

Andreas

[jkat54]

Shouldn't it be y:\ ?

Are you testing as the same user that splunk runs as?

[matchpump]

Yes, y: is just a typo.
Splunk is running as administrator as same as the testing user.

The number of the index will be much more than the number of alphabets.
So the frozen path is needed to be subdirectory of a drive letter.