Splunk Search

What is the format of the Sources.data file?

matt
Splunk Employee
Splunk Employee
$SPLUNK_HOME/var/lib/splunk/defaultdb/db/Sources.data

On a fresh install I see this file has something like this:

0 0 2147483647 0 0

What are the significance of these numbers?

Can you provide any more insight into what this file does and how it is structured?

Tags (2)
1 Solution

V_at_Splunk
Splunk Employee
Splunk Employee

The first line is special (meta-metadata? hmm); after that, lines look like

7   source::/home/v/stable/cloud/summary/global.cskv    20   1260176339  1263593861  1263593861

As far as "user-friendly" content goes, the 3rd field (in this example, 20) is the # of events.

What the *.data files do: they are nonvolatile snapshots of the metadata -- which can also be queried via splunk search. When you search | metadata type=sources | stats sum(totalCount) as count, that's the same as doing awk 'NR>1 {sum += $3} END {print sum}' Sources.data, except that querying metadata through splunk search is more likely to give you fresh totals.

Querying metadata files (*.data) is recommended only if:

  • your instance is down
  • you don't want to pollute any Splunk logs with your queries
  • you really like awk(1)       😉

View solution in original post

V_at_Splunk
Splunk Employee
Splunk Employee

The first line is special (meta-metadata? hmm); after that, lines look like

7   source::/home/v/stable/cloud/summary/global.cskv    20   1260176339  1263593861  1263593861

As far as "user-friendly" content goes, the 3rd field (in this example, 20) is the # of events.

What the *.data files do: they are nonvolatile snapshots of the metadata -- which can also be queried via splunk search. When you search | metadata type=sources | stats sum(totalCount) as count, that's the same as doing awk 'NR>1 {sum += $3} END {print sum}' Sources.data, except that querying metadata through splunk search is more likely to give you fresh totals.

Querying metadata files (*.data) is recommended only if:

  • your instance is down
  • you don't want to pollute any Splunk logs with your queries
  • you really like awk(1)       😉

V_at_Splunk
Splunk Employee
Splunk Employee

Please be aware that Sources.data is not a configuration file -- it gets overwritten by splunkd every 10 to 60 seconds.

0 Karma
Get Updates on the Splunk Community!

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...

Stay Connected: Your Guide to February Tech Talks, Office Hours, and Webinars!

💌Keep the new year’s momentum going with our February lineup of Community Office Hours, Tech Talks, ...