$_index_name in indexes doesn't expand when moving indexes to frozed

[jni]

Hi,

I have issues with Splunk Enterprise 9.4.2 not expanding $_index_name from etc/system/local/indexes.conf.

My default-section:
[default]

...

coldToFrozenDir = $SPLUNK_DB/$_index_name/frozendb

...

This should be fine if I read the docs for indexes.conf 

The config file is read, especially since it creates the $SPLUNK_DB/'$_index_name'/frozendb, i.e. without expanding the variable. $SPLUNK_DB is still expanded correctly. 

Googling turned up the answer in Splunk data retention - Splunk Community, but the resolution there is to manually expanding it and putting the $SPLUNK_DB/"indexname"/frozen under each stanza. And I'm not that keen on doing that.

TIA

Johan

[PrewinThomas]

@jni 

As @livehybrid  mentioned, Splunk does not support dynamic variable expansion for $_index_name in coldToFrozenDir.

Manually specifying coldToFrozenDir per index stanza is the only reliable method.
Eg:

[web_logs]
coldToFrozenDir = $SPLUNK_DB/web_logs/frozendb

Regards,
Prewin
If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!

[livehybrid · Accepted solution]

Hi @jni 

Unfortunately it isnt possible to use $_index_name in coldToFrozenDir, infact, in hindsight I dont think its possible to use it in thawedPath either, despite it being in the example in the docs! The coldToFrozenDir must be an absolute path with no variable substitution.

coldToFrozenDir = <path to frozen archive>
* An alternative to a 'coldToFrozen' script - this setting lets you
  specify a destination path for the frozen archive.
* Splunk software automatically puts frozen buckets in this directory
* For information on how buckets created by different versions are
  handled, see "Freezing and Thawing" below.
* If both 'coldToFrozenDir' and 'coldToFrozenScript' are specified,
  'coldToFrozenDir' takes precedence
* You must restart splunkd after changing this setting. Reloading the
  configuration does not suffice.
* May NOT contain a volume reference.

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing