Getting Data In

$_index_name in indexes doesn't expand when moving indexes to frozed

jni
Explorer

Hi,

 

I have issues with Splunk Enterprise 9.4.2 not expanding $_index_name from etc/system/local/indexes.conf.

My default-section:
[default]

...

coldToFrozenDir = $SPLUNK_DB/$_index_name/frozendb

...

This should be fine if I read the docs for indexes.conf 

The config file is read, especially since it creates the $SPLUNK_DB/'$_index_name'/frozendb, i.e. without expanding the variable. $SPLUNK_DB is still expanded correctly. 

 

Googling turned up the answer in Splunk data retention - Splunk Community, but the resolution there is to manually expanding it and putting the $SPLUNK_DB/"indexname"/frozen under each stanza. And I'm not that keen on doing that.

 

TIA

Johan

Labels (3)
0 Karma
1 Solution

livehybrid
SplunkTrust
SplunkTrust

Hi @jni 

Unfortunately it isnt possible to use $_index_name in coldToFrozenDir, infact, in hindsight I dont think its possible to use it in thawedPath either, despite it being in the example in the docs! The coldToFrozenDir must be an absolute path with no variable substitution.

coldToFrozenDir = <path to frozen archive>
* An alternative to a 'coldToFrozen' script - this setting lets you
  specify a destination path for the frozen archive.
* Splunk software automatically puts frozen buckets in this directory
* For information on how buckets created by different versions are
  handled, see "Freezing and Thawing" below.
* If both 'coldToFrozenDir' and 'coldToFrozenScript' are specified,
  'coldToFrozenDir' takes precedence
* You must restart splunkd after changing this setting. Reloading the
  configuration does not suffice.
* May NOT contain a volume reference.

🌟 Did this answer help you? If so, please consider:

  • Adding karma to show it was useful
  • Marking it as the solution if it resolved your issue
  • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

View solution in original post

PrewinThomas
Motivator

@jni 

As @livehybrid  mentioned, Splunk does not support dynamic variable expansion for $_index_name in coldToFrozenDir.

Manually specifying coldToFrozenDir per index stanza is the only reliable method.
Eg:

[web_logs]
coldToFrozenDir = $SPLUNK_DB/web_logs/frozendb


Regards,
Prewin
If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!

livehybrid
SplunkTrust
SplunkTrust

Hi @jni 

Unfortunately it isnt possible to use $_index_name in coldToFrozenDir, infact, in hindsight I dont think its possible to use it in thawedPath either, despite it being in the example in the docs! The coldToFrozenDir must be an absolute path with no variable substitution.

coldToFrozenDir = <path to frozen archive>
* An alternative to a 'coldToFrozen' script - this setting lets you
  specify a destination path for the frozen archive.
* Splunk software automatically puts frozen buckets in this directory
* For information on how buckets created by different versions are
  handled, see "Freezing and Thawing" below.
* If both 'coldToFrozenDir' and 'coldToFrozenScript' are specified,
  'coldToFrozenDir' takes precedence
* You must restart splunkd after changing this setting. Reloading the
  configuration does not suffice.
* May NOT contain a volume reference.

🌟 Did this answer help you? If so, please consider:

  • Adding karma to show it was useful
  • Marking it as the solution if it resolved your issue
  • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...

Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...

Financial services organizations face an impossible equation: maintain 99.9% uptime for mission-critical ...

Customer success is front and center at .conf25

Hi Splunkers, If you are not able to be at .conf25 in person, you can still learn about all the latest news ...