I'm working on trying to figure out how to get the index name to show up correctly instead of placing the files in a folder named '$_index_name' on my backup folder on the indexer.
On the Cluster Master under $Splunk_Home/etc/master-apps/local/indexes.conf I have the following:
[default]
homePath = volume:primary/$_index_name/db --works correctly with variable
coldPath = volume:cold/$_index_name/db --works correctly with variable
coldToFrozenDir = /'foldername'/frozen/$_index_name --DOES NOT WORK CORRECTLY -'foldername' is irrelevant here and just a name of a folder.
Now, on the Indexer, where I want the data to go is to /'foldername'/frozen/
It's getting there on the Indexer however, it's coming in as /'foldername'/frozen/$_index_name/db
I'm running into the issue that this '$_index_name' is not translating to the index name and has created a folder named '$_index_name' instead of the actual index name.
Looking for a little guidance and solution to this challenge.
Should I NOT use the environment variable and use only the absolute path on the 'coldToFrozenDir'?
This is only on 1 indexer which I want to roll down to about 9 more so I'm looking for the best practice.
I've looked here before posting this question: https://answers.splunk.com/answers/108178/index-name-variable-to-use-in-all-index-paths.html
Any insight will be helpful moving forward.
... View more