Splunk Enterprise

tsidxWritingLevel field is empty when calling Splunk REST API

Dominik_K
Loves-to-Learn Lots

Splunk version: 8.1.1
OS: CentOS 7.9

My indexes.conf file looks like this:

 

[default]
tsidxWritingLevel = 4

[mynewindex]
coldPath = $SPLUNK_DB/mynewindex/colddb
enableDataIntegrityControl = 0
enableTsidxReduction = 0
homePath = $SPLUNK_DB/mynewindex/db
maxTotalDataSizeMB = 512000
thawedPath = $SPLUNK_DB/mynewindex/thaweddb
tsidxWritingLevel = 4

 

 

 

What is my goal?
I want to ensure that tsidxWritingLevel = 4 is actually set up and is working.

So I ran an API query in Splunk:

 

| rest /services/data/indexes

 


But tsidxWritingLevel field is empty all the way down. Why is that? How can check that Splunk is actually using tsidxWritingLevel = 4?

Output from btool:

 

[root@localhost local]# /opt/splunk/bin/splunk btool indexes list --debug | grep local
/opt/splunk/etc/system/local/indexes.conf      journalCompression = zstd
/opt/splunk/etc/system/local/indexes.conf      tsidxWritingLevel = 4
/opt/splunk/etc/system/local/indexes.conf      [_internal]
/opt/splunk/etc/system/local/indexes.conf      journalCompression = zstd
/opt/splunk/etc/system/local/indexes.conf      tsidxWritingLevel = 4
/opt/splunk/etc/system/local/indexes.conf      journalCompression = zstd
/opt/splunk/etc/system/local/indexes.conf      tsidxWritingLevel = 4
/opt/splunk/etc/system/local/indexes.conf      journalCompression = zstd
/opt/splunk/etc/system/local/indexes.conf      tsidxWritingLevel = 4
/opt/splunk/etc/system/local/indexes.conf      journalCompression = zstd
/opt/splunk/etc/system/local/indexes.conf      tsidxWritingLevel = 4
/opt/splunk/etc/system/local/indexes.conf      journalCompression = zstd
/opt/splunk/etc/system/local/indexes.conf      tsidxWritingLevel = 4
/opt/splunk/etc/system/local/indexes.conf      journalCompression = zstd
/opt/splunk/etc/system/local/indexes.conf      tsidxWritingLevel = 4
/opt/splunk/etc/system/local/indexes.conf      [default]
/opt/splunk/etc/system/local/indexes.conf      journalCompression = zstd
/opt/splunk/etc/system/local/indexes.conf      tsidxWritingLevel = 4
/opt/splunk/etc/system/local/indexes.conf      journalCompression = zstd
/opt/splunk/etc/system/local/indexes.conf      tsidxWritingLevel = 4
/opt/splunk/etc/system/local/indexes.conf      journalCompression = zstd
/opt/splunk/etc/system/local/indexes.conf      tsidxWritingLevel = 4
/opt/splunk/etc/apps/search/local/indexes.conf [mynewindex]
/opt/splunk/etc/apps/search/local/indexes.conf coldPath = $SPLUNK_DB/mynewindex/colddb
/opt/splunk/etc/apps/search/local/indexes.conf enableDataIntegrityControl = 0
/opt/splunk/etc/apps/search/local/indexes.conf enableTsidxReduction = 0
/opt/splunk/etc/apps/search/local/indexes.conf homePath = $SPLUNK_DB/mynewindex/db
/opt/splunk/etc/system/local/indexes.conf      journalCompression = zstd
/opt/splunk/etc/apps/search/local/indexes.conf maxTotalDataSizeMB = 512000
/opt/splunk/etc/apps/search/local/indexes.conf thawedPath = $SPLUNK_DB/mynewindex/thaweddb
/opt/splunk/etc/apps/search/local/indexes.conf tsidxWritingLevel = 4
/opt/splunk/etc/system/local/indexes.conf      journalCompression = zstd
/opt/splunk/etc/system/local/indexes.conf      tsidxWritingLevel = 4
/opt/splunk/etc/system/local/indexes.conf      journalCompression = zstd
/opt/splunk/etc/system/local/indexes.conf      tsidxWritingLevel = 4
/opt/splunk/etc/system/local/indexes.conf      journalCompression = zstd
/opt/splunk/etc/system/local/indexes.conf      tsidxWritingLevel = 4

 

 

Labels (1)
0 Karma

Dominik_K
Loves-to-Learn Lots

I tried to run different API call in Splunk

| rest /services/configs/conf-indexes

 And this one is actually returning tsidxWritingLevel field showing value 4.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Agent Mode Engaged! Enchaining Agentic Operations with Splunk AI Assistant 2.0

    Are you ready to transform how your team handles complex data requests? We invite you to our upcoming ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...