Reporting

indexer fails to create the report acceleration summary folders per index with custom location

Communicator

Report acceleration is failing because splunk cannot create the folder for the summary (summaryHomePath ).
This seems linked to my custom homePaths.

It works for this index, and the folder /opt/splunk/var/lib/splunk/index1/summary is created.
[index1]
homePath=$SPLUNK_DB/index1/db
coldPath=$SPLUNK_DB/index1/colddb
thawedPath=$SPLUNK_DB/index1/thaweddb

It fails for this one, and no folder /summary is created.
[index2]
homePath=/index2db
coldPath=/index2_colddb
thawedPath=/index2_thaweddb

0 Karma
1 Solution

Splunk Employee
Splunk Employee

This is a known bug in splunk 5.* and 6.0
http://docs.splunk.com/Documentation/Splunk/6.0/ReleaseNotes/KnownIssues#Unsorted_issues

Summary folders (summaryHomePath) cannot be created if the homePath of the index is at the root of the filesystem, (homePath=D:\myindex or homePath=/myindex). The workaround is to create the folder manually. (SPL-71645)

The workarounds are :

  • to create the folder manually, and specify the summaryHomePath parameter in indexes.conf. Beware you do not want to have the summary as a subfolder of the homePath or coldPath.
  • Or to use folder architecture similar to the splunk one : homePath=/indexname/db

Or to use folder architecture similar to the splunk one : homePath=/indexname/db

see indexes.conf
summaryHomePath = <path on index server>
* An absolute path where transparent summarization results for data in this index
* should be stored. Must be different for each index and may be on any disk drive.
* If not specified it defaults to homePath/../summary/
* CAUTION: Path must be writable.
* May NOT contain a volume reference.
* Must restart splunkd after changing this parameter; index reload will not suffice.

View solution in original post

0 Karma

Splunk Employee
Splunk Employee

This is a known bug in splunk 5.* and 6.0
http://docs.splunk.com/Documentation/Splunk/6.0/ReleaseNotes/KnownIssues#Unsorted_issues

Summary folders (summaryHomePath) cannot be created if the homePath of the index is at the root of the filesystem, (homePath=D:\myindex or homePath=/myindex). The workaround is to create the folder manually. (SPL-71645)

The workarounds are :

  • to create the folder manually, and specify the summaryHomePath parameter in indexes.conf. Beware you do not want to have the summary as a subfolder of the homePath or coldPath.
  • Or to use folder architecture similar to the splunk one : homePath=/indexname/db

Or to use folder architecture similar to the splunk one : homePath=/indexname/db

see indexes.conf
summaryHomePath = <path on index server>
* An absolute path where transparent summarization results for data in this index
* should be stored. Must be different for each index and may be on any disk drive.
* If not specified it defaults to homePath/../summary/
* CAUTION: Path must be writable.
* May NOT contain a volume reference.
* Must restart splunkd after changing this parameter; index reload will not suffice.

View solution in original post

0 Karma