Getting Data In
Highlighted

Why are indexes with hot/warm and cold paths on volumes showing as empty in dbinspect?

Path Finder

This seems weird. My index clusters (dev, qa, and production environments) seem to be completely ignoring my indexes configuration.

The sizeOnDiskMB value for indexes in /opt/splunk shows values as expected. And when I tweaked my indexes.conf, the cluster dutifully froze buckets. But for indexes with hot/warm and cold volumes, sizeOnDeskMB is ZERO. Weird.

I'm on 7.0.7.

0 Karma
Highlighted

Re: Why are indexes with hot/warm and cold paths on volumes showing as empty in dbinspect?

Path Finder

So I might have answered this question with the help of Splunk support. We'll know after our maintenance window this afternoon.

In short, when we defined our volumes, we chose a path on the file system which contains a protected keyword which is present in code. In our case, we chose /splunkdb-hot. And as it turns out, db-hot used to be part of the name of hot buckets in older versions of Splunk.

Will update again soon.

0 Karma