Getting Data In

Why are indexes with hot/warm and cold paths on volumes showing as empty in dbinspect?

brettwilliams
Path Finder

This seems weird. My index clusters (dev, qa, and production environments) seem to be completely ignoring my indexes configuration.

The sizeOnDiskMB value for indexes in /opt/splunk shows values as expected. And when I tweaked my indexes.conf, the cluster dutifully froze buckets. But for indexes with hot/warm and cold volumes, sizeOnDeskMB is ZERO. Weird.

I'm on 7.0.7.

0 Karma

brettwilliams
Path Finder

So I might have answered this question with the help of Splunk support. We'll know after our maintenance window this afternoon.

In short, when we defined our volumes, we chose a path on the file system which contains a protected keyword which is present in code. In our case, we chose /splunkdb-hot. And as it turns out, db-hot used to be part of the name of hot buckets in older versions of Splunk.

Will update again soon.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...