I'm working in a test lab trying to move/archive files using the following indexes.conf file on our cluster master:
[main]
repFactor = auto
homePath = $SPLUNK_DB\defaultdb\db
coldPath = $SPLUNK_DB\defaultdb\colddb
thawedPath = $SPLUNK_DB\defaultdb\thaweddb
maxWarmDBCount = 2
maxDataSize = auto_high_volume
frozenTimePeriodInSecs = 86400
coldToFrozenDir = "$SPLUNK_HOME\Archive\defaultdb"
I'm getting the following error when trying to distribute it:
Vader:Cannot create index 'main': path of coldToFrozenDir must be absolute ('"C:\Program Files\Splunk"')
Palpatine:Cannot create index 'main': path of coldToFrozenDir must be absolute ('"C:\Program Files\Splunk"')
Any ideas?
Thanks,
Joe
I figured out my issue....a simple typo was causing the issue.
For reference this is what I had:
[main]
repFactor = auto
homePath = $SPLUNK_DB\defaultdb\db
coldPath = $SPLUNK_DB\defaultdb\colddb
thawedPath = $SPLUNK_DB\defaultdb\thaweddb
maxWarmDBCount = 2
maxDataSize = auto_high_volume
frozenTimePeriodInSecs = 86400
coldToFrozenDir = "C:\Program Files\Splunk\Archive\defaultdb"
This is what I did to fix it (remove the quotes around the coldToFrozenDir path and add $SPLUNK_HOME):
[main]
repFactor = auto
homePath = $SPLUNK_DB\defaultdb\db
coldPath = $SPLUNK_DB\defaultdb\colddb
thawedPath = $SPLUNK_DB\defaultdb\thaweddb
maxWarmDBCount = 2
maxDataSize = auto_high_volume
frozenTimePeriodInSecs = 86400
coldToFrozenDir = $SPLUNK_HOME\Splunk\Archive\defaultdb