Reporting

indexer fails to create the report acceleration summary folders per index with custom location

mataharry
Communicator

Report acceleration is failing because splunk cannot create the folder for the summary (summaryHomePath ).
This seems linked to my custom homePaths.

It works for this index, and the folder /opt/splunk/var/lib/splunk/index1/summary is created.
[index1]
homePath=$SPLUNK_DB/index1/db
coldPath=$SPLUNK_DB/index1/colddb
thawedPath=$SPLUNK_DB/index1/thaweddb

It fails for this one, and no folder /summary is created.
[index2]
homePath=/index2db
coldPath=/index2_colddb
thawedPath=/index2_thaweddb

0 Karma
1 Solution

yannK
Splunk Employee
Splunk Employee

This is a known bug in splunk 5.* and 6.0
http://docs.splunk.com/Documentation/Splunk/6.0/ReleaseNotes/KnownIssues#Unsorted_issues

Summary folders (summaryHomePath) cannot be created if the homePath of the index is at the root of the filesystem, (homePath=D:\myindex or homePath=/myindex). The workaround is to create the folder manually. (SPL-71645)

The workarounds are :

  • to create the folder manually, and specify the summaryHomePath parameter in indexes.conf. Beware you do not want to have the summary as a subfolder of the homePath or coldPath.
  • Or to use folder architecture similar to the splunk one : homePath=/indexname/db

Or to use folder architecture similar to the splunk one : homePath=/indexname/db

see indexes.conf
summaryHomePath = <path on index server>
* An absolute path where transparent summarization results for data in this index
* should be stored. Must be different for each index and may be on any disk drive.
* If not specified it defaults to homePath/../summary/
* CAUTION: Path must be writable.
* May NOT contain a volume reference.
* Must restart splunkd after changing this parameter; index reload will not suffice.

View solution in original post

0 Karma

yannK
Splunk Employee
Splunk Employee

This is a known bug in splunk 5.* and 6.0
http://docs.splunk.com/Documentation/Splunk/6.0/ReleaseNotes/KnownIssues#Unsorted_issues

Summary folders (summaryHomePath) cannot be created if the homePath of the index is at the root of the filesystem, (homePath=D:\myindex or homePath=/myindex). The workaround is to create the folder manually. (SPL-71645)

The workarounds are :

  • to create the folder manually, and specify the summaryHomePath parameter in indexes.conf. Beware you do not want to have the summary as a subfolder of the homePath or coldPath.
  • Or to use folder architecture similar to the splunk one : homePath=/indexname/db

Or to use folder architecture similar to the splunk one : homePath=/indexname/db

see indexes.conf
summaryHomePath = <path on index server>
* An absolute path where transparent summarization results for data in this index
* should be stored. Must be different for each index and may be on any disk drive.
* If not specified it defaults to homePath/../summary/
* CAUTION: Path must be writable.
* May NOT contain a volume reference.
* Must restart splunkd after changing this parameter; index reload will not suffice.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...