indexer fails to create the report acceleration summary folders per index with custom location

[mataharry]

Report acceleration is failing because splunk cannot create the folder for the summary (summaryHomePath ).
This seems linked to my custom homePaths.

It works for this index, and the folder /opt/splunk/var/lib/splunk/index1/summary is created.
[index1]
homePath=$SPLUNK_DB/index1/db
coldPath=$SPLUNK_DB/index1/colddb
thawedPath=$SPLUNK_DB/index1/thaweddb


It fails for this one, and no folder /summary is created.
[index2]
homePath=/index2db
coldPath=/index2_colddb
thawedPath=/index2_thaweddb


[yannK · Accepted solution]

This is a known bug in splunk 5.* and 6.0
http://docs.splunk.com/Documentation/Splunk/6.0/ReleaseNotes/KnownIssues#Unsorted_issues

Summary folders (summaryHomePath) cannot be created if the homePath of the index is at the root of the filesystem, (homePath=D:\myindex or homePath=/myindex). The workaround is to create the folder manually. (SPL-71645)

The workarounds are :

• to create the folder manually, and specify the summaryHomePath parameter in indexes.conf. Beware you do not want to have the summary as a subfolder of the homePath or coldPath.
• Or to use folder architecture similar to the splunk one : homePath=/indexname/db

Or to use folder architecture similar to the splunk one : homePath=/indexname/db

see indexes.conf
summaryHomePath = <path on index server>
* An absolute path where transparent summarization results for data in this index
* should be stored. Must be different for each index and may be on any disk drive.
* If not specified it defaults to homePath/../summary/
* CAUTION: Path must be writable.
* May NOT contain a volume reference.
* Must restart splunkd after changing this parameter; index reload will not suffice.