Get indexes API not returning expanded home and cold path. Splunk Version: 9.4.5

[Commvault]

I am calling this API: GET /services/data/indexes/<index-name>

The values of homePath_expanded and coldPath_expanded are not being resolved to return the absolute path, but it returns the following data:

<s:key name="homePath_expanded">volume:hotwarm/$_index_name/db</s:key>

<s:key name="coldPath_expanded">volume:cold/$_index_name/colddb</s:key>

Can someone please help me if I can check something to resolve this?

[PrewinThomas]

@Commvault 

The API is returning volume:hotwarm/... instead of an absolute filesystem path because your index is defined using volume references in indexes.conf. Splunk does not expand those into full paths unless the volume stanza itself has an absolute path configured.

you can combine the two REST endpoints (/services/data/indexes and /services/data/index-volumes) to show full path.
Try something below,

| rest /services/data/indexes
| fields title homePath_expanded coldPath_expanded
| rex field=homePath_expanded "(?<homeVol>volume:[^/]+)"
| rex field=coldPath_expanded "(?<coldVol>volume:[^/]+)"
| join type=left homeVol [ | rest /services/data/index-volumes | fields title volume_path | rename title as homeVol volume_path as homeBase ]
| join type=left coldVol [ | rest /services/data/index-volumes | fields title volume_path | rename title as coldVol volume_path as coldBase ]
| eval homePathResolved=replace(homePath_expanded,homeVol,homeBase)
| eval coldPathResolved=replace(coldPath_expanded,coldVol,coldBase)
| table title homePathResolved coldPathResolved

Regards,
Prewin
🌟If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!

[Commvault]

Hi @PrewinThomas 

I do have the following data in the indexes.conf file:

[volume:cold]
path = /splunk-data/cold

[volume:hotwarm]
path = /splunk-data/hotwarm
maxVolumeDataSizeMB = 4500000

[wineventlog]
homePath = volume:hotwarm/$_index_name/db
coldPath = volume:cold/$_index_name/colddb
tstatsHomePath = volume:hotwarm/$_index_name/datamodel_summary
thawedPath = /splunk-data/cold/$_index_name/thaweddb

Are there any logs that will tell if there was an issue in resolving these paths?