Getting Data In

Why are indexes with hot/warm and cold paths on volumes showing as empty in dbinspect?

brettwilliams
Path Finder

This seems weird. My index clusters (dev, qa, and production environments) seem to be completely ignoring my indexes configuration.

The sizeOnDiskMB value for indexes in /opt/splunk shows values as expected. And when I tweaked my indexes.conf, the cluster dutifully froze buckets. But for indexes with hot/warm and cold volumes, sizeOnDeskMB is ZERO. Weird.

I'm on 7.0.7.

0 Karma

brettwilliams
Path Finder

So I might have answered this question with the help of Splunk support. We'll know after our maintenance window this afternoon.

In short, when we defined our volumes, we chose a path on the file system which contains a protected keyword which is present in code. In our case, we chose /splunkdb-hot. And as it turns out, db-hot used to be part of the name of hot buckets in older versions of Splunk.

Will update again soon.

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!