Getting Data In

$_index_name in indexes doesn't expand when moving indexes to frozed

jni
Explorer

Hi,

 

I have issues with Splunk Enterprise 9.4.2 not expanding $_index_name from etc/system/local/indexes.conf.

My default-section:
[default]

...

coldToFrozenDir = $SPLUNK_DB/$_index_name/frozendb

...

This should be fine if I read the docs for indexes.conf 

The config file is read, especially since it creates the $SPLUNK_DB/'$_index_name'/frozendb, i.e. without expanding the variable. $SPLUNK_DB is still expanded correctly. 

 

Googling turned up the answer in Splunk data retention - Splunk Community, but the resolution there is to manually expanding it and putting the $SPLUNK_DB/"indexname"/frozen under each stanza. And I'm not that keen on doing that.

 

TIA

Johan

Labels (3)
0 Karma
1 Solution

livehybrid
SplunkTrust
SplunkTrust

Hi @jni 

Unfortunately it isnt possible to use $_index_name in coldToFrozenDir, infact, in hindsight I dont think its possible to use it in thawedPath either, despite it being in the example in the docs! The coldToFrozenDir must be an absolute path with no variable substitution.

coldToFrozenDir = <path to frozen archive>
* An alternative to a 'coldToFrozen' script - this setting lets you
  specify a destination path for the frozen archive.
* Splunk software automatically puts frozen buckets in this directory
* For information on how buckets created by different versions are
  handled, see "Freezing and Thawing" below.
* If both 'coldToFrozenDir' and 'coldToFrozenScript' are specified,
  'coldToFrozenDir' takes precedence
* You must restart splunkd after changing this setting. Reloading the
  configuration does not suffice.
* May NOT contain a volume reference.

🌟 Did this answer help you? If so, please consider:

  • Adding karma to show it was useful
  • Marking it as the solution if it resolved your issue
  • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

View solution in original post

PrewinThomas
Motivator

@jni 

As @livehybrid  mentioned, Splunk does not support dynamic variable expansion for $_index_name in coldToFrozenDir.

Manually specifying coldToFrozenDir per index stanza is the only reliable method.
Eg:

[web_logs]
coldToFrozenDir = $SPLUNK_DB/web_logs/frozendb


Regards,
Prewin
If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!

livehybrid
SplunkTrust
SplunkTrust

Hi @jni 

Unfortunately it isnt possible to use $_index_name in coldToFrozenDir, infact, in hindsight I dont think its possible to use it in thawedPath either, despite it being in the example in the docs! The coldToFrozenDir must be an absolute path with no variable substitution.

coldToFrozenDir = <path to frozen archive>
* An alternative to a 'coldToFrozen' script - this setting lets you
  specify a destination path for the frozen archive.
* Splunk software automatically puts frozen buckets in this directory
* For information on how buckets created by different versions are
  handled, see "Freezing and Thawing" below.
* If both 'coldToFrozenDir' and 'coldToFrozenScript' are specified,
  'coldToFrozenDir' takes precedence
* You must restart splunkd after changing this setting. Reloading the
  configuration does not suffice.
* May NOT contain a volume reference.

🌟 Did this answer help you? If so, please consider:

  • Adding karma to show it was useful
  • Marking it as the solution if it resolved your issue
  • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...