Reporting

indexer fails to create the report acceleration summary folders per index with custom location

mataharry
Communicator

Report acceleration is failing because splunk cannot create the folder for the summary (summaryHomePath ).
This seems linked to my custom homePaths.

It works for this index, and the folder /opt/splunk/var/lib/splunk/index1/summary is created.
[index1]
homePath=$SPLUNK_DB/index1/db
coldPath=$SPLUNK_DB/index1/colddb
thawedPath=$SPLUNK_DB/index1/thaweddb

It fails for this one, and no folder /summary is created.
[index2]
homePath=/index2db
coldPath=/index2_colddb
thawedPath=/index2_thaweddb

0 Karma
1 Solution

yannK
Splunk Employee
Splunk Employee

This is a known bug in splunk 5.* and 6.0
http://docs.splunk.com/Documentation/Splunk/6.0/ReleaseNotes/KnownIssues#Unsorted_issues

Summary folders (summaryHomePath) cannot be created if the homePath of the index is at the root of the filesystem, (homePath=D:\myindex or homePath=/myindex). The workaround is to create the folder manually. (SPL-71645)

The workarounds are :

  • to create the folder manually, and specify the summaryHomePath parameter in indexes.conf. Beware you do not want to have the summary as a subfolder of the homePath or coldPath.
  • Or to use folder architecture similar to the splunk one : homePath=/indexname/db

Or to use folder architecture similar to the splunk one : homePath=/indexname/db

see indexes.conf
summaryHomePath = <path on index server>
* An absolute path where transparent summarization results for data in this index
* should be stored. Must be different for each index and may be on any disk drive.
* If not specified it defaults to homePath/../summary/
* CAUTION: Path must be writable.
* May NOT contain a volume reference.
* Must restart splunkd after changing this parameter; index reload will not suffice.

View solution in original post

0 Karma

yannK
Splunk Employee
Splunk Employee

This is a known bug in splunk 5.* and 6.0
http://docs.splunk.com/Documentation/Splunk/6.0/ReleaseNotes/KnownIssues#Unsorted_issues

Summary folders (summaryHomePath) cannot be created if the homePath of the index is at the root of the filesystem, (homePath=D:\myindex or homePath=/myindex). The workaround is to create the folder manually. (SPL-71645)

The workarounds are :

  • to create the folder manually, and specify the summaryHomePath parameter in indexes.conf. Beware you do not want to have the summary as a subfolder of the homePath or coldPath.
  • Or to use folder architecture similar to the splunk one : homePath=/indexname/db

Or to use folder architecture similar to the splunk one : homePath=/indexname/db

see indexes.conf
summaryHomePath = <path on index server>
* An absolute path where transparent summarization results for data in this index
* should be stored. Must be different for each index and may be on any disk drive.
* If not specified it defaults to homePath/../summary/
* CAUTION: Path must be writable.
* May NOT contain a volume reference.
* Must restart splunkd after changing this parameter; index reload will not suffice.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...