Splunk Enterprise

tsidxWritingLevel field is empty when calling Splunk REST API

Dominik_K
Loves-to-Learn Lots

Splunk version: 8.1.1
OS: CentOS 7.9

My indexes.conf file looks like this:

 

[default]
tsidxWritingLevel = 4

[mynewindex]
coldPath = $SPLUNK_DB/mynewindex/colddb
enableDataIntegrityControl = 0
enableTsidxReduction = 0
homePath = $SPLUNK_DB/mynewindex/db
maxTotalDataSizeMB = 512000
thawedPath = $SPLUNK_DB/mynewindex/thaweddb
tsidxWritingLevel = 4

 

 

 

What is my goal?
I want to ensure that tsidxWritingLevel = 4 is actually set up and is working.

So I ran an API query in Splunk:

 

| rest /services/data/indexes

 


But tsidxWritingLevel field is empty all the way down. Why is that? How can check that Splunk is actually using tsidxWritingLevel = 4?

Output from btool:

 

[root@localhost local]# /opt/splunk/bin/splunk btool indexes list --debug | grep local
/opt/splunk/etc/system/local/indexes.conf      journalCompression = zstd
/opt/splunk/etc/system/local/indexes.conf      tsidxWritingLevel = 4
/opt/splunk/etc/system/local/indexes.conf      [_internal]
/opt/splunk/etc/system/local/indexes.conf      journalCompression = zstd
/opt/splunk/etc/system/local/indexes.conf      tsidxWritingLevel = 4
/opt/splunk/etc/system/local/indexes.conf      journalCompression = zstd
/opt/splunk/etc/system/local/indexes.conf      tsidxWritingLevel = 4
/opt/splunk/etc/system/local/indexes.conf      journalCompression = zstd
/opt/splunk/etc/system/local/indexes.conf      tsidxWritingLevel = 4
/opt/splunk/etc/system/local/indexes.conf      journalCompression = zstd
/opt/splunk/etc/system/local/indexes.conf      tsidxWritingLevel = 4
/opt/splunk/etc/system/local/indexes.conf      journalCompression = zstd
/opt/splunk/etc/system/local/indexes.conf      tsidxWritingLevel = 4
/opt/splunk/etc/system/local/indexes.conf      journalCompression = zstd
/opt/splunk/etc/system/local/indexes.conf      tsidxWritingLevel = 4
/opt/splunk/etc/system/local/indexes.conf      [default]
/opt/splunk/etc/system/local/indexes.conf      journalCompression = zstd
/opt/splunk/etc/system/local/indexes.conf      tsidxWritingLevel = 4
/opt/splunk/etc/system/local/indexes.conf      journalCompression = zstd
/opt/splunk/etc/system/local/indexes.conf      tsidxWritingLevel = 4
/opt/splunk/etc/system/local/indexes.conf      journalCompression = zstd
/opt/splunk/etc/system/local/indexes.conf      tsidxWritingLevel = 4
/opt/splunk/etc/apps/search/local/indexes.conf [mynewindex]
/opt/splunk/etc/apps/search/local/indexes.conf coldPath = $SPLUNK_DB/mynewindex/colddb
/opt/splunk/etc/apps/search/local/indexes.conf enableDataIntegrityControl = 0
/opt/splunk/etc/apps/search/local/indexes.conf enableTsidxReduction = 0
/opt/splunk/etc/apps/search/local/indexes.conf homePath = $SPLUNK_DB/mynewindex/db
/opt/splunk/etc/system/local/indexes.conf      journalCompression = zstd
/opt/splunk/etc/apps/search/local/indexes.conf maxTotalDataSizeMB = 512000
/opt/splunk/etc/apps/search/local/indexes.conf thawedPath = $SPLUNK_DB/mynewindex/thaweddb
/opt/splunk/etc/apps/search/local/indexes.conf tsidxWritingLevel = 4
/opt/splunk/etc/system/local/indexes.conf      journalCompression = zstd
/opt/splunk/etc/system/local/indexes.conf      tsidxWritingLevel = 4
/opt/splunk/etc/system/local/indexes.conf      journalCompression = zstd
/opt/splunk/etc/system/local/indexes.conf      tsidxWritingLevel = 4
/opt/splunk/etc/system/local/indexes.conf      journalCompression = zstd
/opt/splunk/etc/system/local/indexes.conf      tsidxWritingLevel = 4

 

 

Labels (1)
0 Karma

Dominik_K
Loves-to-Learn Lots

I tried to run different API call in Splunk

| rest /services/configs/conf-indexes

 And this one is actually returning tsidxWritingLevel field showing value 4.

0 Karma
Get Updates on the Splunk Community!

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...

New! Splunk Observability Search Enhancements for Splunk APM Services/Traces and ...

Regardless of where you are in Splunk Observability, you can search for relevant APM targets including service ...

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...