By default, Splunk stores its indexes under SPLUNK_HOME in the

kteng2024 · ‎02-28-2017

for an index, i specified the following:

[abc]
homePath = $SPLUNK_DB/abc/db
coldPath = $SPLUNK_DB/abc/colddb
thawedPath = $SPLUNK_DB/abc/thaweddb

since i used "$SPLUNK_DB" i don't see it in /var/lib/splunk , so can i please know where i could see those directories?

woodcock · ‎02-28-2017

The SPLUNK_DB environment variable is defaulted in the software as follows (from $SPLUNK_HOME/etc/splunk-launch.conf😞

By default, Splunk stores its indexes under SPLUNK_HOME in the

var\lib\splunk subdirectory. This can be overridden

here:

SPLUNK_DB=C:\wrangler-2.0\build-home\ivory\var\lib\splunk

Therefore, your files should be found (if there are no splunk-launch.conf files that modify the default) inside $SPLUNK_HOME/var/lib/splunk/ which for linux with a standard installation should be /opt/splunk/var/lib/splunk/.

View solution in original post

woodcock · ‎02-28-2017

The SPLUNK_DB environment variable is defaulted in the software as follows (from $SPLUNK_HOME/etc/splunk-launch.conf😞

By default, Splunk stores its indexes under SPLUNK_HOME in the

var\lib\splunk subdirectory. This can be overridden

here:

SPLUNK_DB=C:\wrangler-2.0\build-home\ivory\var\lib\splunk

Therefore, your files should be found (if there are no splunk-launch.conf files that modify the default) inside $SPLUNK_HOME/var/lib/splunk/ which for linux with a standard installation should be /opt/splunk/var/lib/splunk/.

somesoni2 · ‎02-28-2017

Did you check in $SPLUNK_HOME/var/lib/splunk ?

Why am I unable to see cold path in Splunk?

By default, Splunk stores its indexes under SPLUNK_HOME in the

var\lib\splunk subdirectory. This can be overridden

here:

SPLUNK_DB=C:\wrangler-2.0\build-home\ivory\var\lib\splunk

By default, Splunk stores its indexes under SPLUNK_HOME in the

var\lib\splunk subdirectory. This can be overridden

here:

SPLUNK_DB=C:\wrangler-2.0\build-home\ivory\var\lib\splunk

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

Event Series: Level up your SOC: Advancing with Splunk Enterprise Security

Announcing Modern Navigation: A New Era of Splunk User Experience

Join the Conversation

Why am I unable to see cold path in Splunk?

By default, Splunk stores its indexes under SPLUNK_HOME in the

var\lib\splunk subdirectory. This can be overridden

here:

SPLUNK_DB=C:\wrangler-2.0\build-home\ivory\var\lib\splunk

By default, Splunk stores its indexes under SPLUNK_HOME in the

var\lib\splunk subdirectory. This can be overridden

here:

SPLUNK_DB=C:\wrangler-2.0\build-home\ivory\var\lib\splunk

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

Event Series: Level up your SOC: Advancing with Splunk Enterprise Security

Announcing Modern Navigation: A New Era of Splunk User Experience