I am having trouble in creating an index.conf, what could be the issue here I not getting it. check attachment, please.
this is what I mention in the vi index.conf
homePath = $SPLUNK_DB/rockyindi/db
coldPath = $SPLUNK_DB/rockyindi/colddb
thawedPath = $SPLUNK_DB/rockyindi/thaweddb
maxDataSize = 10000
maxTotalDataSizeMB = 100000
maxWarmDBCount = 200
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
[rockyindi]
homePath = volume:home/rockyindi/db
coldPath = volume:cold/rockyindi/colddb
thawedPath = volume:cold/rockyindi/thaweddb
# Let volumes handle size, set high limit per index (set to 1GB * 1 year * 365 days). Just to be safe
maxTotalDataSizeMB = 365000
# 1 years x 365 days * 24 hrs * 60mins * 60secs days total retention
frozenTimePeriodInSecs = 31536000
repFactor = auto
That should work. Restart your indexer and watch for errors then try to write to it.
thank you woodcock.
[rockyindi]
homePath = volume:home/rockyindi/db
coldPath = volume:cold/rockyindi/colddb
thawedPath = volume:cold/rockyindi/thaweddb
# Let volumes handle size, set high limit per index (set to 1GB * 1 year * 365 days). Just to be safe
maxTotalDataSizeMB = 365000
# 1 years x 365 days * 24 hrs * 60mins * 60secs days total retention
frozenTimePeriodInSecs = 31536000
repFactor = auto
i tried this but it didn't worked. no idea whats going wrong.
appreciate your time.
I realized it was permission issue, thanks for your help