Why am I unable to see cold path in Splunk?

[kteng2024]

for an index, i specified the following:

[abc]
homePath = $SPLUNK_DB/abc/db
coldPath = $SPLUNK_DB/abc/colddb
thawedPath = $SPLUNK_DB/abc/thaweddb

since i used "$SPLUNK_DB" i don't see it in /var/lib/splunk , so can i please know where i could see those directories?

[woodcock · Accepted solution]

The SPLUNK_DB environment variable is defaulted in the software as follows (from $SPLUNK_HOME/etc/splunk-launch.conf😞

By default, Splunk stores its indexes under SPLUNK_HOME in the

var\lib\splunk subdirectory. This can be overridden

here:

SPLUNK_DB=C:\wrangler-2.0\build-home\ivory\var\lib\splunk

Therefore, your files should be found (if there are no splunk-launch.conf files that modify the default) inside $SPLUNK_HOME/var/lib/splunk/ which for linux with a standard installation should be /opt/splunk/var/lib/splunk/.

[somesoni2]

Did you check in $SPLUNK_HOME/var/lib/splunk ?