Splunk Enterprise

tsidxWritingLevel field is empty when calling Splunk REST API

Dominik_K
Loves-to-Learn Lots

Splunk version: 8.1.1
OS: CentOS 7.9

My indexes.conf file looks like this:

 

[default]
tsidxWritingLevel = 4

[mynewindex]
coldPath = $SPLUNK_DB/mynewindex/colddb
enableDataIntegrityControl = 0
enableTsidxReduction = 0
homePath = $SPLUNK_DB/mynewindex/db
maxTotalDataSizeMB = 512000
thawedPath = $SPLUNK_DB/mynewindex/thaweddb
tsidxWritingLevel = 4

 

 

 

What is my goal?
I want to ensure that tsidxWritingLevel = 4 is actually set up and is working.

So I ran an API query in Splunk:

 

| rest /services/data/indexes

 


But tsidxWritingLevel field is empty all the way down. Why is that? How can check that Splunk is actually using tsidxWritingLevel = 4?

Output from btool:

 

[root@localhost local]# /opt/splunk/bin/splunk btool indexes list --debug | grep local
/opt/splunk/etc/system/local/indexes.conf      journalCompression = zstd
/opt/splunk/etc/system/local/indexes.conf      tsidxWritingLevel = 4
/opt/splunk/etc/system/local/indexes.conf      [_internal]
/opt/splunk/etc/system/local/indexes.conf      journalCompression = zstd
/opt/splunk/etc/system/local/indexes.conf      tsidxWritingLevel = 4
/opt/splunk/etc/system/local/indexes.conf      journalCompression = zstd
/opt/splunk/etc/system/local/indexes.conf      tsidxWritingLevel = 4
/opt/splunk/etc/system/local/indexes.conf      journalCompression = zstd
/opt/splunk/etc/system/local/indexes.conf      tsidxWritingLevel = 4
/opt/splunk/etc/system/local/indexes.conf      journalCompression = zstd
/opt/splunk/etc/system/local/indexes.conf      tsidxWritingLevel = 4
/opt/splunk/etc/system/local/indexes.conf      journalCompression = zstd
/opt/splunk/etc/system/local/indexes.conf      tsidxWritingLevel = 4
/opt/splunk/etc/system/local/indexes.conf      journalCompression = zstd
/opt/splunk/etc/system/local/indexes.conf      tsidxWritingLevel = 4
/opt/splunk/etc/system/local/indexes.conf      [default]
/opt/splunk/etc/system/local/indexes.conf      journalCompression = zstd
/opt/splunk/etc/system/local/indexes.conf      tsidxWritingLevel = 4
/opt/splunk/etc/system/local/indexes.conf      journalCompression = zstd
/opt/splunk/etc/system/local/indexes.conf      tsidxWritingLevel = 4
/opt/splunk/etc/system/local/indexes.conf      journalCompression = zstd
/opt/splunk/etc/system/local/indexes.conf      tsidxWritingLevel = 4
/opt/splunk/etc/apps/search/local/indexes.conf [mynewindex]
/opt/splunk/etc/apps/search/local/indexes.conf coldPath = $SPLUNK_DB/mynewindex/colddb
/opt/splunk/etc/apps/search/local/indexes.conf enableDataIntegrityControl = 0
/opt/splunk/etc/apps/search/local/indexes.conf enableTsidxReduction = 0
/opt/splunk/etc/apps/search/local/indexes.conf homePath = $SPLUNK_DB/mynewindex/db
/opt/splunk/etc/system/local/indexes.conf      journalCompression = zstd
/opt/splunk/etc/apps/search/local/indexes.conf maxTotalDataSizeMB = 512000
/opt/splunk/etc/apps/search/local/indexes.conf thawedPath = $SPLUNK_DB/mynewindex/thaweddb
/opt/splunk/etc/apps/search/local/indexes.conf tsidxWritingLevel = 4
/opt/splunk/etc/system/local/indexes.conf      journalCompression = zstd
/opt/splunk/etc/system/local/indexes.conf      tsidxWritingLevel = 4
/opt/splunk/etc/system/local/indexes.conf      journalCompression = zstd
/opt/splunk/etc/system/local/indexes.conf      tsidxWritingLevel = 4
/opt/splunk/etc/system/local/indexes.conf      journalCompression = zstd
/opt/splunk/etc/system/local/indexes.conf      tsidxWritingLevel = 4

 

 

Labels (1)
0 Karma

Dominik_K
Loves-to-Learn Lots

I tried to run different API call in Splunk

| rest /services/configs/conf-indexes

 And this one is actually returning tsidxWritingLevel field showing value 4.

0 Karma
Get Updates on the Splunk Community!

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer at Splunk .conf24 ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...