Getting Data In

Was there a change in Splunk 6.1.5 with how an indexer reads indexes.conf compared to previous versions?

cevyn
Explorer

In the process of migrating to an indexes app instead of fixed /opt/splunk/etc/system/local/indexes.conf, I did a search against the indexer.

As soon as I renamed indexes.conf prior to restart (and picking up indexes.conf elsewhere in directory structure -prior to download of app), a search against that indexer immediately reported - no data ( for any window of time).
As soon as I renamed it back - data became available again.

It appears that forwarders continued to send data to the indexer the whole time.

Is there shift in how and when Splunk reads these config files? Indexes.conf in particular.
That was not how I remember it working on older versions.

0 Karma

dart
Splunk Employee
Splunk Employee

I'm not aware of any difference, but the best way to diagnose if you have different configuration when you change your setup is to use btool to give a before and after and if there is a difference you can run with debug so you can see where each configuration item is coming from. Splunk doesn't need to be running for this, so you can make changes and keep doing it until everything matches up.

./bin/splunk btool indexes list 
./bin/splunk btool indexes list --debug

I like to run it into a vim buffer like so:

./bin/splunk btool indexes list --debug | vim -

The dash makes vim read stdin into a new buffer.
Another alternative is to diff it

./bin/splunk btool indexes list > /tmp/indexes.old 
mv ... # make your changes
./bin/splunk btool indexes list > /tmp/indexes.new
diff -u /tmp/indexes.{old,new} | less
0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out >> As our brave ...