Getting Data In

Why am I getting error "Cannot create index 'main': path of coldToFrozenDir must be absolute" trying to move/archive files on Windows?

Contributor

I'm working in a test lab trying to move/archive files using the following indexes.conf file on our cluster master:

[main]
repFactor = auto
homePath   = $SPLUNK_DB\defaultdb\db
coldPath   = $SPLUNK_DB\defaultdb\colddb
thawedPath = $SPLUNK_DB\defaultdb\thaweddb
maxWarmDBCount = 2
maxDataSize = auto_high_volume
frozenTimePeriodInSecs = 86400
coldToFrozenDir = "$SPLUNK_HOME\Archive\defaultdb" 

I'm getting the following error when trying to distribute it:

Vader:Cannot create index 'main': path of coldToFrozenDir must be absolute ('"C:\Program Files\Splunk"')
Palpatine:Cannot create index 'main': path of coldToFrozenDir must be absolute ('"C:\Program Files\Splunk"')

Any ideas?

Thanks,
Joe

0 Karma
1 Solution

Contributor

I figured out my issue....a simple typo was causing the issue.

For reference this is what I had:

 [main]
 repFactor = auto
 homePath   = $SPLUNK_DB\defaultdb\db
 coldPath   = $SPLUNK_DB\defaultdb\colddb
 thawedPath = $SPLUNK_DB\defaultdb\thaweddb
 maxWarmDBCount = 2
 maxDataSize = auto_high_volume
 frozenTimePeriodInSecs = 86400
 coldToFrozenDir = "C:\Program Files\Splunk\Archive\defaultdb" 

This is what I did to fix it (remove the quotes around the coldToFrozenDir path and add $SPLUNK_HOME):

[main]
repFactor = auto
homePath   = $SPLUNK_DB\defaultdb\db
coldPath   = $SPLUNK_DB\defaultdb\colddb
thawedPath = $SPLUNK_DB\defaultdb\thaweddb
maxWarmDBCount = 2
maxDataSize = auto_high_volume
frozenTimePeriodInSecs = 86400
coldToFrozenDir = $SPLUNK_HOME\Splunk\Archive\defaultdb

View solution in original post

Go ahead and create the directory structure and see if that works. It is probably complaining that the directory doesn't exist, so it isn't able to write the index files.

0 Karma

Contributor

I figured out my issue....a simple typo was causing the issue.

For reference this is what I had:

 [main]
 repFactor = auto
 homePath   = $SPLUNK_DB\defaultdb\db
 coldPath   = $SPLUNK_DB\defaultdb\colddb
 thawedPath = $SPLUNK_DB\defaultdb\thaweddb
 maxWarmDBCount = 2
 maxDataSize = auto_high_volume
 frozenTimePeriodInSecs = 86400
 coldToFrozenDir = "C:\Program Files\Splunk\Archive\defaultdb" 

This is what I did to fix it (remove the quotes around the coldToFrozenDir path and add $SPLUNK_HOME):

[main]
repFactor = auto
homePath   = $SPLUNK_DB\defaultdb\db
coldPath   = $SPLUNK_DB\defaultdb\colddb
thawedPath = $SPLUNK_DB\defaultdb\thaweddb
maxWarmDBCount = 2
maxDataSize = auto_high_volume
frozenTimePeriodInSecs = 86400
coldToFrozenDir = $SPLUNK_HOME\Splunk\Archive\defaultdb

View solution in original post

Ah, that error message makes sense now with the double quoting. Good catch!

Contributor

So it works, but my buckets did not move. They were simply deleted out of the following directory:

$SPLUNK_HOME\var\lib\splunk\defaultdb\colddb

Any suggestions?

0 Karma

Contributor

Eh I think I found my second issue..... man I'm full of typos and out of coffee today.... SMH.

Looks like:

coldToFrozenDir = $SPLUNK_HOME\Splunk\Archive\defaultdb

Should really be:

coldToFrozenDir = $SPLUNK_HOME\Archive\defaultdb
0 Karma

Builder

Hi,

You have to setup

coldToFrozenDir = C:\Program Files\Splunk\Archive\defaultdb"

Hope help you

0 Karma

Contributor

I modified my indexes.conf to reflect this and it did not work:

[main]
repFactor = auto
homePath   = $SPLUNK_DB\defaultdb\db
coldPath   = $SPLUNK_DB\defaultdb\colddb
thawedPath = $SPLUNK_DB\defaultdb\thaweddb
maxWarmDBCount = 2
maxDataSize = auto_high_volume
frozenTimePeriodInSecs = 86400
coldToFrozenDir = "C:\Program Files\Splunk\Archive\defaultdb" 

Still getting:

Cannot create index 'main': path of coldToFrozenDir must be absolute ('"C:\Program Files\Splunk\Archive\defaultdb"')
0 Karma

Builder

No quotes

coldToFrozenDir = C:\Program Files\Splunk\Archive\defaultdb

hope help you

Dumb question, but do you have defaultdb created in C:\Program Files\Splunk\Archive\?

Contributor

I do not, should I?
First time doing this.

Thanks,
Joe

0 Karma