Splunk Enterprise

tsidxWritingLevel field is empty when calling Splunk REST API

Dominik_K
Loves-to-Learn Lots

Splunk version: 8.1.1
OS: CentOS 7.9

My indexes.conf file looks like this:

 

[default]
tsidxWritingLevel = 4

[mynewindex]
coldPath = $SPLUNK_DB/mynewindex/colddb
enableDataIntegrityControl = 0
enableTsidxReduction = 0
homePath = $SPLUNK_DB/mynewindex/db
maxTotalDataSizeMB = 512000
thawedPath = $SPLUNK_DB/mynewindex/thaweddb
tsidxWritingLevel = 4

 

 

 

What is my goal?
I want to ensure that tsidxWritingLevel = 4 is actually set up and is working.

So I ran an API query in Splunk:

 

| rest /services/data/indexes

 


But tsidxWritingLevel field is empty all the way down. Why is that? How can check that Splunk is actually using tsidxWritingLevel = 4?

Output from btool:

 

[root@localhost local]# /opt/splunk/bin/splunk btool indexes list --debug | grep local
/opt/splunk/etc/system/local/indexes.conf      journalCompression = zstd
/opt/splunk/etc/system/local/indexes.conf      tsidxWritingLevel = 4
/opt/splunk/etc/system/local/indexes.conf      [_internal]
/opt/splunk/etc/system/local/indexes.conf      journalCompression = zstd
/opt/splunk/etc/system/local/indexes.conf      tsidxWritingLevel = 4
/opt/splunk/etc/system/local/indexes.conf      journalCompression = zstd
/opt/splunk/etc/system/local/indexes.conf      tsidxWritingLevel = 4
/opt/splunk/etc/system/local/indexes.conf      journalCompression = zstd
/opt/splunk/etc/system/local/indexes.conf      tsidxWritingLevel = 4
/opt/splunk/etc/system/local/indexes.conf      journalCompression = zstd
/opt/splunk/etc/system/local/indexes.conf      tsidxWritingLevel = 4
/opt/splunk/etc/system/local/indexes.conf      journalCompression = zstd
/opt/splunk/etc/system/local/indexes.conf      tsidxWritingLevel = 4
/opt/splunk/etc/system/local/indexes.conf      journalCompression = zstd
/opt/splunk/etc/system/local/indexes.conf      tsidxWritingLevel = 4
/opt/splunk/etc/system/local/indexes.conf      [default]
/opt/splunk/etc/system/local/indexes.conf      journalCompression = zstd
/opt/splunk/etc/system/local/indexes.conf      tsidxWritingLevel = 4
/opt/splunk/etc/system/local/indexes.conf      journalCompression = zstd
/opt/splunk/etc/system/local/indexes.conf      tsidxWritingLevel = 4
/opt/splunk/etc/system/local/indexes.conf      journalCompression = zstd
/opt/splunk/etc/system/local/indexes.conf      tsidxWritingLevel = 4
/opt/splunk/etc/apps/search/local/indexes.conf [mynewindex]
/opt/splunk/etc/apps/search/local/indexes.conf coldPath = $SPLUNK_DB/mynewindex/colddb
/opt/splunk/etc/apps/search/local/indexes.conf enableDataIntegrityControl = 0
/opt/splunk/etc/apps/search/local/indexes.conf enableTsidxReduction = 0
/opt/splunk/etc/apps/search/local/indexes.conf homePath = $SPLUNK_DB/mynewindex/db
/opt/splunk/etc/system/local/indexes.conf      journalCompression = zstd
/opt/splunk/etc/apps/search/local/indexes.conf maxTotalDataSizeMB = 512000
/opt/splunk/etc/apps/search/local/indexes.conf thawedPath = $SPLUNK_DB/mynewindex/thaweddb
/opt/splunk/etc/apps/search/local/indexes.conf tsidxWritingLevel = 4
/opt/splunk/etc/system/local/indexes.conf      journalCompression = zstd
/opt/splunk/etc/system/local/indexes.conf      tsidxWritingLevel = 4
/opt/splunk/etc/system/local/indexes.conf      journalCompression = zstd
/opt/splunk/etc/system/local/indexes.conf      tsidxWritingLevel = 4
/opt/splunk/etc/system/local/indexes.conf      journalCompression = zstd
/opt/splunk/etc/system/local/indexes.conf      tsidxWritingLevel = 4

 

 

Labels (1)
0 Karma

Dominik_K
Loves-to-Learn Lots

I tried to run different API call in Splunk

| rest /services/configs/conf-indexes

 And this one is actually returning tsidxWritingLevel field showing value 4.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Rounding off the Splunk Dashboard Contest

What does a contest-winning Splunk dashboard look like? In this case, it isn't in a browser tab at all. It ...

A Four Part Event Series: AI + Observability: AI Agents, LLMs, Apps, & Infrastructure

AI + Observability: AI Agents, LLMs, Apps, & Infrastructure The rapid evolution of artificial intelligence ...