Splunk Enterprise Security

Help me in creating a index.conf for new index.

Rocky31
Path Finder

I am having trouble in creating an index.conf, what could be the issue here I not getting it. check attachment, please.

this is what I mention in the vi index.conf

homePath = $SPLUNK_DB/rockyindi/db
coldPath = $SPLUNK_DB/rockyindi/colddb
thawedPath = $SPLUNK_DB/rockyindi/thaweddb
maxDataSize = 10000
maxTotalDataSizeMB = 100000
maxWarmDBCount = 200
~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

0 Karma
1 Solution

koshyk
Super Champion
  1. Have you specified a Index Volume group? It is highly recommend to have a volume settings to abstract physical storage. Please read indexes.conf for details
  2. Once you define Volume for your hot/cold/thawed etc, below setting should be good enough for basic purposes
indexes.conf setting
[rockyindi]
  homePath   = volume:home/rockyindi/db
  coldPath = volume:cold/rockyindi/colddb
  thawedPath = volume:cold/rockyindi/thaweddb
  # Let volumes handle size, set high limit per index (set to 1GB  * 1 year * 365 days). Just to be safe
  maxTotalDataSizeMB = 365000
  # 1 years x 365 days * 24 hrs * 60mins * 60secs days total retention
  frozenTimePeriodInSecs = 31536000
  repFactor = auto

View solution in original post

woodcock
Esteemed Legend

That should work. Restart your indexer and watch for errors then try to write to it.

Rocky31
Path Finder

thank you woodcock.

0 Karma

koshyk
Super Champion
  1. Have you specified a Index Volume group? It is highly recommend to have a volume settings to abstract physical storage. Please read indexes.conf for details
  2. Once you define Volume for your hot/cold/thawed etc, below setting should be good enough for basic purposes
indexes.conf setting
[rockyindi]
  homePath   = volume:home/rockyindi/db
  coldPath = volume:cold/rockyindi/colddb
  thawedPath = volume:cold/rockyindi/thaweddb
  # Let volumes handle size, set high limit per index (set to 1GB  * 1 year * 365 days). Just to be safe
  maxTotalDataSizeMB = 365000
  # 1 years x 365 days * 24 hrs * 60mins * 60secs days total retention
  frozenTimePeriodInSecs = 31536000
  repFactor = auto

Rocky31
Path Finder

i tried this but it didn't worked. no idea whats going wrong.
appreciate your time.

0 Karma

Rocky31
Path Finder

I realized it was permission issue, thanks for your help

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...