Splunk version: 8.1.1
OS: CentOS 7.9
My indexes.conf file looks like this:
[default]
tsidxWritingLevel = 4
[mynewindex]
coldPath = $SPLUNK_DB/mynewindex/colddb
enableDataIntegrityControl = 0
enableTsidxReduction = 0
homePath = $SPLUNK_DB/mynewindex/db
maxTotalDataSizeMB = 512000
thawedPath = $SPLUNK_DB/mynewindex/thaweddb
tsidxWritingLevel = 4
What is my goal?
I want to ensure that tsidxWritingLevel = 4 is actually set up and is working.
So I ran an API query in Splunk:
| rest /services/data/indexes
But tsidxWritingLevel field is empty all the way down. Why is that? How can check that Splunk is actually using tsidxWritingLevel = 4?
Output from btool:
[root@localhost local]# /opt/splunk/bin/splunk btool indexes list --debug | grep local
/opt/splunk/etc/system/local/indexes.conf journalCompression = zstd
/opt/splunk/etc/system/local/indexes.conf tsidxWritingLevel = 4
/opt/splunk/etc/system/local/indexes.conf [_internal]
/opt/splunk/etc/system/local/indexes.conf journalCompression = zstd
/opt/splunk/etc/system/local/indexes.conf tsidxWritingLevel = 4
/opt/splunk/etc/system/local/indexes.conf journalCompression = zstd
/opt/splunk/etc/system/local/indexes.conf tsidxWritingLevel = 4
/opt/splunk/etc/system/local/indexes.conf journalCompression = zstd
/opt/splunk/etc/system/local/indexes.conf tsidxWritingLevel = 4
/opt/splunk/etc/system/local/indexes.conf journalCompression = zstd
/opt/splunk/etc/system/local/indexes.conf tsidxWritingLevel = 4
/opt/splunk/etc/system/local/indexes.conf journalCompression = zstd
/opt/splunk/etc/system/local/indexes.conf tsidxWritingLevel = 4
/opt/splunk/etc/system/local/indexes.conf journalCompression = zstd
/opt/splunk/etc/system/local/indexes.conf tsidxWritingLevel = 4
/opt/splunk/etc/system/local/indexes.conf [default]
/opt/splunk/etc/system/local/indexes.conf journalCompression = zstd
/opt/splunk/etc/system/local/indexes.conf tsidxWritingLevel = 4
/opt/splunk/etc/system/local/indexes.conf journalCompression = zstd
/opt/splunk/etc/system/local/indexes.conf tsidxWritingLevel = 4
/opt/splunk/etc/system/local/indexes.conf journalCompression = zstd
/opt/splunk/etc/system/local/indexes.conf tsidxWritingLevel = 4
/opt/splunk/etc/apps/search/local/indexes.conf [mynewindex]
/opt/splunk/etc/apps/search/local/indexes.conf coldPath = $SPLUNK_DB/mynewindex/colddb
/opt/splunk/etc/apps/search/local/indexes.conf enableDataIntegrityControl = 0
/opt/splunk/etc/apps/search/local/indexes.conf enableTsidxReduction = 0
/opt/splunk/etc/apps/search/local/indexes.conf homePath = $SPLUNK_DB/mynewindex/db
/opt/splunk/etc/system/local/indexes.conf journalCompression = zstd
/opt/splunk/etc/apps/search/local/indexes.conf maxTotalDataSizeMB = 512000
/opt/splunk/etc/apps/search/local/indexes.conf thawedPath = $SPLUNK_DB/mynewindex/thaweddb
/opt/splunk/etc/apps/search/local/indexes.conf tsidxWritingLevel = 4
/opt/splunk/etc/system/local/indexes.conf journalCompression = zstd
/opt/splunk/etc/system/local/indexes.conf tsidxWritingLevel = 4
/opt/splunk/etc/system/local/indexes.conf journalCompression = zstd
/opt/splunk/etc/system/local/indexes.conf tsidxWritingLevel = 4
/opt/splunk/etc/system/local/indexes.conf journalCompression = zstd
/opt/splunk/etc/system/local/indexes.conf tsidxWritingLevel = 4
I tried to run different API call in Splunk
| rest /services/configs/conf-indexes
And this one is actually returning tsidxWritingLevel field showing value 4.