Getting Data In

Why am I getting error "Cannot create index 'main': path of coldToFrozenDir must be absolute" trying to move/archive files on Windows?

hagjos43
Contributor

I'm working in a test lab trying to move/archive files using the following indexes.conf file on our cluster master:

[main]
repFactor = auto
homePath   = $SPLUNK_DB\defaultdb\db
coldPath   = $SPLUNK_DB\defaultdb\colddb
thawedPath = $SPLUNK_DB\defaultdb\thaweddb
maxWarmDBCount = 2
maxDataSize = auto_high_volume
frozenTimePeriodInSecs = 86400
coldToFrozenDir = "$SPLUNK_HOME\Archive\defaultdb" 

I'm getting the following error when trying to distribute it:

Vader:Cannot create index 'main': path of coldToFrozenDir must be absolute ('"C:\Program Files\Splunk"')
Palpatine:Cannot create index 'main': path of coldToFrozenDir must be absolute ('"C:\Program Files\Splunk"')

Any ideas?

Thanks,
Joe

0 Karma
1 Solution

hagjos43
Contributor

I figured out my issue....a simple typo was causing the issue.

For reference this is what I had:

 [main]
 repFactor = auto
 homePath   = $SPLUNK_DB\defaultdb\db
 coldPath   = $SPLUNK_DB\defaultdb\colddb
 thawedPath = $SPLUNK_DB\defaultdb\thaweddb
 maxWarmDBCount = 2
 maxDataSize = auto_high_volume
 frozenTimePeriodInSecs = 86400
 coldToFrozenDir = "C:\Program Files\Splunk\Archive\defaultdb" 

This is what I did to fix it (remove the quotes around the coldToFrozenDir path and add $SPLUNK_HOME):

[main]
repFactor = auto
homePath   = $SPLUNK_DB\defaultdb\db
coldPath   = $SPLUNK_DB\defaultdb\colddb
thawedPath = $SPLUNK_DB\defaultdb\thaweddb
maxWarmDBCount = 2
maxDataSize = auto_high_volume
frozenTimePeriodInSecs = 86400
coldToFrozenDir = $SPLUNK_HOME\Splunk\Archive\defaultdb

View solution in original post

jerniganbrandon
Explorer

Go ahead and create the directory structure and see if that works. It is probably complaining that the directory doesn't exist, so it isn't able to write the index files.

0 Karma

hagjos43
Contributor

I figured out my issue....a simple typo was causing the issue.

For reference this is what I had:

 [main]
 repFactor = auto
 homePath   = $SPLUNK_DB\defaultdb\db
 coldPath   = $SPLUNK_DB\defaultdb\colddb
 thawedPath = $SPLUNK_DB\defaultdb\thaweddb
 maxWarmDBCount = 2
 maxDataSize = auto_high_volume
 frozenTimePeriodInSecs = 86400
 coldToFrozenDir = "C:\Program Files\Splunk\Archive\defaultdb" 

This is what I did to fix it (remove the quotes around the coldToFrozenDir path and add $SPLUNK_HOME):

[main]
repFactor = auto
homePath   = $SPLUNK_DB\defaultdb\db
coldPath   = $SPLUNK_DB\defaultdb\colddb
thawedPath = $SPLUNK_DB\defaultdb\thaweddb
maxWarmDBCount = 2
maxDataSize = auto_high_volume
frozenTimePeriodInSecs = 86400
coldToFrozenDir = $SPLUNK_HOME\Splunk\Archive\defaultdb

jerniganbrandon
Explorer

Ah, that error message makes sense now with the double quoting. Good catch!

hagjos43
Contributor

So it works, but my buckets did not move. They were simply deleted out of the following directory:

$SPLUNK_HOME\var\lib\splunk\defaultdb\colddb

Any suggestions?

0 Karma

hagjos43
Contributor

Eh I think I found my second issue..... man I'm full of typos and out of coffee today.... SMH.

Looks like:

coldToFrozenDir = $SPLUNK_HOME\Splunk\Archive\defaultdb

Should really be:

coldToFrozenDir = $SPLUNK_HOME\Archive\defaultdb
0 Karma

jmallorquin
Builder

Hi,

You have to setup

coldToFrozenDir = C:\Program Files\Splunk\Archive\defaultdb"

Hope help you

0 Karma

hagjos43
Contributor

I modified my indexes.conf to reflect this and it did not work:

[main]
repFactor = auto
homePath   = $SPLUNK_DB\defaultdb\db
coldPath   = $SPLUNK_DB\defaultdb\colddb
thawedPath = $SPLUNK_DB\defaultdb\thaweddb
maxWarmDBCount = 2
maxDataSize = auto_high_volume
frozenTimePeriodInSecs = 86400
coldToFrozenDir = "C:\Program Files\Splunk\Archive\defaultdb" 

Still getting:

Cannot create index 'main': path of coldToFrozenDir must be absolute ('"C:\Program Files\Splunk\Archive\defaultdb"')
0 Karma

jmallorquin
Builder

No quotes

coldToFrozenDir = C:\Program Files\Splunk\Archive\defaultdb

hope help you

jerniganbrandon
Explorer

Dumb question, but do you have defaultdb created in C:\Program Files\Splunk\Archive\?

hagjos43
Contributor

I do not, should I?
First time doing this.

Thanks,
Joe

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...