Splunk Search

What is the format of the Sources.data file?

matt
Splunk Employee
Splunk Employee
$SPLUNK_HOME/var/lib/splunk/defaultdb/db/Sources.data

On a fresh install I see this file has something like this:

0 0 2147483647 0 0

What are the significance of these numbers?

Can you provide any more insight into what this file does and how it is structured?

Tags (2)
1 Solution

V_at_Splunk
Splunk Employee
Splunk Employee

The first line is special (meta-metadata? hmm); after that, lines look like

7   source::/home/v/stable/cloud/summary/global.cskv    20   1260176339  1263593861  1263593861

As far as "user-friendly" content goes, the 3rd field (in this example, 20) is the # of events.

What the *.data files do: they are nonvolatile snapshots of the metadata -- which can also be queried via splunk search. When you search | metadata type=sources | stats sum(totalCount) as count, that's the same as doing awk 'NR>1 {sum += $3} END {print sum}' Sources.data, except that querying metadata through splunk search is more likely to give you fresh totals.

Querying metadata files (*.data) is recommended only if:

  • your instance is down
  • you don't want to pollute any Splunk logs with your queries
  • you really like awk(1)       😉

View solution in original post

V_at_Splunk
Splunk Employee
Splunk Employee

The first line is special (meta-metadata? hmm); after that, lines look like

7   source::/home/v/stable/cloud/summary/global.cskv    20   1260176339  1263593861  1263593861

As far as "user-friendly" content goes, the 3rd field (in this example, 20) is the # of events.

What the *.data files do: they are nonvolatile snapshots of the metadata -- which can also be queried via splunk search. When you search | metadata type=sources | stats sum(totalCount) as count, that's the same as doing awk 'NR>1 {sum += $3} END {print sum}' Sources.data, except that querying metadata through splunk search is more likely to give you fresh totals.

Querying metadata files (*.data) is recommended only if:

  • your instance is down
  • you don't want to pollute any Splunk logs with your queries
  • you really like awk(1)       😉

V_at_Splunk
Splunk Employee
Splunk Employee

Please be aware that Sources.data is not a configuration file -- it gets overwritten by splunkd every 10 to 60 seconds.

0 Karma
Get Updates on the Splunk Community!

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...