Splunk Search

How to specify the path of a custom Database, while creating an index using command line

ajay_hbo
Engager

Hi I am trying to create an index on the command line as follows (splunk 4.1.4) ./bin/splunk add index indexname -dir $SPLUNK_DB/indexdb

But for some reason, splunk 4.1.4 fails to recognize "-dir". Does any one know if there is another way of specifying the name of my custom splunk DB, at the command line?

Genti
Splunk Employee
Splunk Employee

Doc Bug filed. Here is the correct command to add an index:

./splunk add index foo -homePath /your/path/foo/db -coldPath /your/path/foo/colddb -thawedPath /your/path/foo/thawedDb

Genti
Splunk Employee
Splunk Employee

from the docs:

    To use Splunk's CLI, navigate to the $SPLUNK_HOME/bin/ directory and

use the ./splunk command.

Important: You must stop Splunk before you edit the properties of an

existing index. You do not need to stop Splunk to create a new index.

To add or edit a new index called "fflanda" using the CLI:

./splunk [add|edit] index fflanda

You can also specify a value for any option in indexes.conf by passing

it as a flag (for example, -dir) to the [add|edit] index command.

You must restart Splunk when you create a new index or edit the

properties of an existing index.

The command fails with the following error:

An error occurred:
 Argument "dir" is not supported by this handler.

Will probably file a doc bug tomorrow and try to find the way its supposed to work..

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

After a whole week of being on call, you fell asleep on your keyboard, and you hit a sequence of buttons that ...