×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
Dominik_K
Loves-to-Learn Lots
Member since: ‎10-23-2020
‎06-09-2021
Community Statistics
Posts 2
Solutions 0
Karma Given 0
Karma Received 0
Member Since ‎10-23-2020
View All

Re: tsidxWritingLevel field is empty when calling ...

by in Splunk Enterprise
‎12-28-2020 06:58 AM
‎12-28-2020 06:58 AM
I tried to run different API call in Splunk | rest /services/configs/conf-indexes  And this one is actually returning tsidxWritingLevel field showing value 4. ... View more

tsidxWritingLevel field is empty when calling Splu...

by in Splunk Enterprise
‎12-28-2020 06:07 AM
‎12-28-2020 06:07 AM
Splunk version: 8.1.1 OS: CentOS 7.9 My indexes.conf file looks like this:   [default] tsidxWritingLevel = 4 [mynewindex] coldPath = $SPLUNK_DB/mynewindex/colddb enableDataIntegrityControl = 0 enableTsidxReduction = 0 homePath = $SPLUNK_DB/mynewindex/db maxTotalDataSizeMB = 512000 thawedPath = $SPLUNK_DB/mynewindex/thaweddb tsidxWritingLevel = 4       What is my goal? I want to ensure that tsidxWritingLevel = 4 is actually set up and is working. So I ran an API query in Splunk:   | rest /services/data/indexes   But tsidxWritingLevel field is empty all the way down. Why is that? How can check that Splunk is actually using tsidxWritingLevel = 4? Output from btool:   [root@localhost local]# /opt/splunk/bin/splunk btool indexes list --debug | grep local /opt/splunk/etc/system/local/indexes.conf journalCompression = zstd /opt/splunk/etc/system/local/indexes.conf tsidxWritingLevel = 4 /opt/splunk/etc/system/local/indexes.conf [_internal] /opt/splunk/etc/system/local/indexes.conf journalCompression = zstd /opt/splunk/etc/system/local/indexes.conf tsidxWritingLevel = 4 /opt/splunk/etc/system/local/indexes.conf journalCompression = zstd /opt/splunk/etc/system/local/indexes.conf tsidxWritingLevel = 4 /opt/splunk/etc/system/local/indexes.conf journalCompression = zstd /opt/splunk/etc/system/local/indexes.conf tsidxWritingLevel = 4 /opt/splunk/etc/system/local/indexes.conf journalCompression = zstd /opt/splunk/etc/system/local/indexes.conf tsidxWritingLevel = 4 /opt/splunk/etc/system/local/indexes.conf journalCompression = zstd /opt/splunk/etc/system/local/indexes.conf tsidxWritingLevel = 4 /opt/splunk/etc/system/local/indexes.conf journalCompression = zstd /opt/splunk/etc/system/local/indexes.conf tsidxWritingLevel = 4 /opt/splunk/etc/system/local/indexes.conf [default] /opt/splunk/etc/system/local/indexes.conf journalCompression = zstd /opt/splunk/etc/system/local/indexes.conf tsidxWritingLevel = 4 /opt/splunk/etc/system/local/indexes.conf journalCompression = zstd /opt/splunk/etc/system/local/indexes.conf tsidxWritingLevel = 4 /opt/splunk/etc/system/local/indexes.conf journalCompression = zstd /opt/splunk/etc/system/local/indexes.conf tsidxWritingLevel = 4 /opt/splunk/etc/apps/search/local/indexes.conf [mynewindex] /opt/splunk/etc/apps/search/local/indexes.conf coldPath = $SPLUNK_DB/mynewindex/colddb /opt/splunk/etc/apps/search/local/indexes.conf enableDataIntegrityControl = 0 /opt/splunk/etc/apps/search/local/indexes.conf enableTsidxReduction = 0 /opt/splunk/etc/apps/search/local/indexes.conf homePath = $SPLUNK_DB/mynewindex/db /opt/splunk/etc/system/local/indexes.conf journalCompression = zstd /opt/splunk/etc/apps/search/local/indexes.conf maxTotalDataSizeMB = 512000 /opt/splunk/etc/apps/search/local/indexes.conf thawedPath = $SPLUNK_DB/mynewindex/thaweddb /opt/splunk/etc/apps/search/local/indexes.conf tsidxWritingLevel = 4 /opt/splunk/etc/system/local/indexes.conf journalCompression = zstd /opt/splunk/etc/system/local/indexes.conf tsidxWritingLevel = 4 /opt/splunk/etc/system/local/indexes.conf journalCompression = zstd /opt/splunk/etc/system/local/indexes.conf tsidxWritingLevel = 4 /opt/splunk/etc/system/local/indexes.conf journalCompression = zstd /opt/splunk/etc/system/local/indexes.conf tsidxWritingLevel = 4     ... View more
Labels
Contact Me
Online Status
Offline
Date Last Visited
‎06-09-2021 02:41 AM