Splunk Enterprise

tsidxWritingLevel field is empty when calling Splunk REST API

Dominik_K
Loves-to-Learn Lots

Splunk version: 8.1.1
OS: CentOS 7.9

My indexes.conf file looks like this:

 

[default]
tsidxWritingLevel = 4

[mynewindex]
coldPath = $SPLUNK_DB/mynewindex/colddb
enableDataIntegrityControl = 0
enableTsidxReduction = 0
homePath = $SPLUNK_DB/mynewindex/db
maxTotalDataSizeMB = 512000
thawedPath = $SPLUNK_DB/mynewindex/thaweddb
tsidxWritingLevel = 4

 

 

 

What is my goal?
I want to ensure that tsidxWritingLevel = 4 is actually set up and is working.

So I ran an API query in Splunk:

 

| rest /services/data/indexes

 


But tsidxWritingLevel field is empty all the way down. Why is that? How can check that Splunk is actually using tsidxWritingLevel = 4?

Output from btool:

 

[root@localhost local]# /opt/splunk/bin/splunk btool indexes list --debug | grep local
/opt/splunk/etc/system/local/indexes.conf      journalCompression = zstd
/opt/splunk/etc/system/local/indexes.conf      tsidxWritingLevel = 4
/opt/splunk/etc/system/local/indexes.conf      [_internal]
/opt/splunk/etc/system/local/indexes.conf      journalCompression = zstd
/opt/splunk/etc/system/local/indexes.conf      tsidxWritingLevel = 4
/opt/splunk/etc/system/local/indexes.conf      journalCompression = zstd
/opt/splunk/etc/system/local/indexes.conf      tsidxWritingLevel = 4
/opt/splunk/etc/system/local/indexes.conf      journalCompression = zstd
/opt/splunk/etc/system/local/indexes.conf      tsidxWritingLevel = 4
/opt/splunk/etc/system/local/indexes.conf      journalCompression = zstd
/opt/splunk/etc/system/local/indexes.conf      tsidxWritingLevel = 4
/opt/splunk/etc/system/local/indexes.conf      journalCompression = zstd
/opt/splunk/etc/system/local/indexes.conf      tsidxWritingLevel = 4
/opt/splunk/etc/system/local/indexes.conf      journalCompression = zstd
/opt/splunk/etc/system/local/indexes.conf      tsidxWritingLevel = 4
/opt/splunk/etc/system/local/indexes.conf      [default]
/opt/splunk/etc/system/local/indexes.conf      journalCompression = zstd
/opt/splunk/etc/system/local/indexes.conf      tsidxWritingLevel = 4
/opt/splunk/etc/system/local/indexes.conf      journalCompression = zstd
/opt/splunk/etc/system/local/indexes.conf      tsidxWritingLevel = 4
/opt/splunk/etc/system/local/indexes.conf      journalCompression = zstd
/opt/splunk/etc/system/local/indexes.conf      tsidxWritingLevel = 4
/opt/splunk/etc/apps/search/local/indexes.conf [mynewindex]
/opt/splunk/etc/apps/search/local/indexes.conf coldPath = $SPLUNK_DB/mynewindex/colddb
/opt/splunk/etc/apps/search/local/indexes.conf enableDataIntegrityControl = 0
/opt/splunk/etc/apps/search/local/indexes.conf enableTsidxReduction = 0
/opt/splunk/etc/apps/search/local/indexes.conf homePath = $SPLUNK_DB/mynewindex/db
/opt/splunk/etc/system/local/indexes.conf      journalCompression = zstd
/opt/splunk/etc/apps/search/local/indexes.conf maxTotalDataSizeMB = 512000
/opt/splunk/etc/apps/search/local/indexes.conf thawedPath = $SPLUNK_DB/mynewindex/thaweddb
/opt/splunk/etc/apps/search/local/indexes.conf tsidxWritingLevel = 4
/opt/splunk/etc/system/local/indexes.conf      journalCompression = zstd
/opt/splunk/etc/system/local/indexes.conf      tsidxWritingLevel = 4
/opt/splunk/etc/system/local/indexes.conf      journalCompression = zstd
/opt/splunk/etc/system/local/indexes.conf      tsidxWritingLevel = 4
/opt/splunk/etc/system/local/indexes.conf      journalCompression = zstd
/opt/splunk/etc/system/local/indexes.conf      tsidxWritingLevel = 4

 

 

Labels (1)
0 Karma

Dominik_K
Loves-to-Learn Lots

I tried to run different API call in Splunk

| rest /services/configs/conf-indexes

 And this one is actually returning tsidxWritingLevel field showing value 4.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to February Tech Talks, Office Hours, and Webinars!

💌 Keep the new year’s momentum going with our February lineup of Community Office Hours, Tech Talks, ...

Preparing your Splunk Environment for OpenSSL3

The Splunk platform will transition to OpenSSL version 3 in a future release. Actions are required to prepare ...

Incident Response: Reduce Incident Recurrence with Automated Ticket Creation

Culture extends beyond work experience and coffee roast preferences on software engineering teams. Team ...