Where are the tsidx files generated by tscollect command written to?

[the_wolverine]

I can't seem to find information in the documentation as to where I can locate the generated tsidx files from my tscollect run are written to when I specify a namespace.

[tfletcher_splun]

The tsidx namespaces generated by tscollect are ALWAYS stored on the search head that executes the tscollect search. They cannot be forwarded or replicated to the indexers. Per indexes.conf.spec you will see the location of the files called out by indexes.conf. You can make things work in search head pooled environments by making the tsidxStatsHomePath property point to some shared storage but it has a performance penalty. Without shared storage you cannot make tscollect based namespaces work in a search head pool or cluster and you will receive no scale benefit from map-reduce.

Data model acceleration works very differently and does keep the accelerated namespaces along side the originating indexes on the indexer tier.

Please see indexes.conf.spec for more details on tsidxStatsHomePath.

[GeorgeStarkey]

Is this still an accurate statement about the tsidx/tscollect artifacts not replicating on a search head cluster?

[somesoni2]

Yes... the tsidexstats is still created only on SH and is not replicated to other SHC members.

[jayannah]

If namespace is provided, the tsidx files are written to a directory of that name under the main tsidxstats directory (that is, within $SPLUNK_DB/tsidxstats). These namespaces can be written to multiple times to add new data. If namespace is not provided, the files are written to a directory within the job directory of that search, and will live as long as the job does. This namespace location is also configurable in indexes.conf, with the attribute tsidxStatsHomePath.

http://docs.splunk.com/Documentation/Splunk/6.2.1/SearchReference/Tscollect

[the_wolverine]

Hi, thanks for your response.
I read the same documentation but I still can't tell where that location is and I'm unable to find it.

Is it on one of the indexers?
Is it on the search head? If so, which one? The SH that I ran tscollect?
(What if I'm logged in to SSO VIP -- I won't know which one in that case.)

If I'm using SH_POOLING, is it located somewhere else?

The documentation is too vague.

[jayannah]

@the_wolverine - tscollect information are stored in Indexers.

[mcronkrite]

Do you use replication in your indexing tier? But in general the indexers have the tsidxstats e.g. $Splunk_DB$/tsidxstats for the index that was involved in the transaction.