Splunk Enterprise Security

Help me in creating a index.conf for new index.

Rocky31
Path Finder

I am having trouble in creating an index.conf, what could be the issue here I not getting it. check attachment, please.

this is what I mention in the vi index.conf

homePath = $SPLUNK_DB/rockyindi/db
coldPath = $SPLUNK_DB/rockyindi/colddb
thawedPath = $SPLUNK_DB/rockyindi/thaweddb
maxDataSize = 10000
maxTotalDataSizeMB = 100000
maxWarmDBCount = 200
~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

0 Karma
1 Solution

koshyk
Super Champion
  1. Have you specified a Index Volume group? It is highly recommend to have a volume settings to abstract physical storage. Please read indexes.conf for details
  2. Once you define Volume for your hot/cold/thawed etc, below setting should be good enough for basic purposes
indexes.conf setting
[rockyindi]
  homePath   = volume:home/rockyindi/db
  coldPath = volume:cold/rockyindi/colddb
  thawedPath = volume:cold/rockyindi/thaweddb
  # Let volumes handle size, set high limit per index (set to 1GB  * 1 year * 365 days). Just to be safe
  maxTotalDataSizeMB = 365000
  # 1 years x 365 days * 24 hrs * 60mins * 60secs days total retention
  frozenTimePeriodInSecs = 31536000
  repFactor = auto

View solution in original post

woodcock
Esteemed Legend

That should work. Restart your indexer and watch for errors then try to write to it.

Rocky31
Path Finder

thank you woodcock.

0 Karma

koshyk
Super Champion
  1. Have you specified a Index Volume group? It is highly recommend to have a volume settings to abstract physical storage. Please read indexes.conf for details
  2. Once you define Volume for your hot/cold/thawed etc, below setting should be good enough for basic purposes
indexes.conf setting
[rockyindi]
  homePath   = volume:home/rockyindi/db
  coldPath = volume:cold/rockyindi/colddb
  thawedPath = volume:cold/rockyindi/thaweddb
  # Let volumes handle size, set high limit per index (set to 1GB  * 1 year * 365 days). Just to be safe
  maxTotalDataSizeMB = 365000
  # 1 years x 365 days * 24 hrs * 60mins * 60secs days total retention
  frozenTimePeriodInSecs = 31536000
  repFactor = auto

Rocky31
Path Finder

i tried this but it didn't worked. no idea whats going wrong.
appreciate your time.

0 Karma

Rocky31
Path Finder

I realized it was permission issue, thanks for your help

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...