Hi,
I have issues with Splunk Enterprise 9.4.2 not expanding $_index_name from etc/system/local/indexes.conf.
My default-section:
[default]
...
coldToFrozenDir = $SPLUNK_DB/$_index_name/frozendb
...
This should be fine if I read the docs for indexes.conf
The config file is read, especially since it creates the $SPLUNK_DB/'$_index_name'/frozendb, i.e. without expanding the variable. $SPLUNK_DB is still expanded correctly.
Googling turned up the answer in Splunk data retention - Splunk Community, but the resolution there is to manually expanding it and putting the $SPLUNK_DB/"indexname"/frozen under each stanza. And I'm not that keen on doing that.
TIA
Johan
Hi @jni
Unfortunately it isnt possible to use $_index_name in coldToFrozenDir, infact, in hindsight I dont think its possible to use it in thawedPath either, despite it being in the example in the docs! The coldToFrozenDir must be an absolute path with no variable substitution.
coldToFrozenDir = <path to frozen archive>
* An alternative to a 'coldToFrozen' script - this setting lets you
specify a destination path for the frozen archive.
* Splunk software automatically puts frozen buckets in this directory
* For information on how buckets created by different versions are
handled, see "Freezing and Thawing" below.
* If both 'coldToFrozenDir' and 'coldToFrozenScript' are specified,
'coldToFrozenDir' takes precedence
* You must restart splunkd after changing this setting. Reloading the
configuration does not suffice.
* May NOT contain a volume reference.
🌟 Did this answer help you? If so, please consider:
Your feedback encourages the volunteers in this community to continue contributing
As @livehybrid mentioned, Splunk does not support dynamic variable expansion for $_index_name in coldToFrozenDir.
Manually specifying coldToFrozenDir per index stanza is the only reliable method.
Eg:
[web_logs]
coldToFrozenDir = $SPLUNK_DB/web_logs/frozendb
Regards,
Prewin
If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!
Hi @jni
Unfortunately it isnt possible to use $_index_name in coldToFrozenDir, infact, in hindsight I dont think its possible to use it in thawedPath either, despite it being in the example in the docs! The coldToFrozenDir must be an absolute path with no variable substitution.
coldToFrozenDir = <path to frozen archive>
* An alternative to a 'coldToFrozen' script - this setting lets you
specify a destination path for the frozen archive.
* Splunk software automatically puts frozen buckets in this directory
* For information on how buckets created by different versions are
handled, see "Freezing and Thawing" below.
* If both 'coldToFrozenDir' and 'coldToFrozenScript' are specified,
'coldToFrozenDir' takes precedence
* You must restart splunkd after changing this setting. Reloading the
configuration does not suffice.
* May NOT contain a volume reference.
🌟 Did this answer help you? If so, please consider:
Your feedback encourages the volunteers in this community to continue contributing