In a distributed search environment, how to find out from which location it reading the configuration file of distsearch.conf ?

[Hemnaath]

Hi All, Please let me know how to find out from which location splunk is reading the configuration file of distsearch.conf ?
I had tried the below btool command and got some out put but not sure whether this the way to search a particular configuration file in splunk.

./splunk cmd btool distsearch list --debug

thanks in advance.

[gcusello]

hi Hemnaath,
You can find it at $SPLUNK_HOME/etc/system/local/ as you can see in http://docs.splunk.com/Documentation/Splunk/6.5.1/admin/Distsearchconf
Every way ./splunk cmd btool distsearch list --debug runs.
Bye.
Giuseppe

[Hemnaath]

how to find out from which location it reading the configuration file of indexes.conf file. Currently we are facing a space crunch in the PCI search head, on investigating we found that splunk internal index like
audit, access_summarydb is consuming more space almost 80GB of space is consumed by this two indexes.

Path
/opt/splunk/var/lib/splunk --> disk usage is almost 95%

my question is how to find out which is the active indexes.conf file from where these configuration files are read in the search head. Kindly let me know whether we can use this btool command to get this input.

./splunk cmd btool indexes list --debug

thanks in advance.

[somesoni2]

The btool command with --debug option should be able to tell you which configuration files are being used by Splunk, for all conf files.

[gcusello]

hi Hemnaath,
about the disk space used for Splunk internal logs, you have to definire your policies and set according retention: e.g. i usually use 2 years for audit logs (that are few!) and a month (or less) for internal logs that are very large, because I usually don't use logs older than a month to debug a problem when I have.

About SHs' internal logs, it's a best practice to send all Splunk infrastructure servers internal logs (not only forwarders) to indexers, to have only one repository to debug problems and one point to configure.

About the active indexes.conf, probably there isn't only one active indexes.conf but there are one active configurations for each index from different indexes.conf files.
To understand which is the active settings for an index, as i said, you have to use btools command.

Bye.
Giuseppe

[nnmiller]

Sounds like you are not forwarding your search head's internal logs to the indexers. This can cause performance issues on the search head in addition to consuming space.

Please have a look at the following docs page: http://docs.splunk.com/Documentation/Splunk/latest/DistSearch/Forwardsearchheaddata