Installation

After Upgrade 7.2.x Fail To Startup

rsantoso_splunk
Splunk Employee
Splunk Employee

After upgrade to 7.2.x fail on startup with the following error:

Problem parsing indexes.conf: Cannot load IndexConfig:
index=summary Path=$SPLUNK_HOME/INDEX_NAME/summary given as value of param=homePath collides with value of param2=summaryHomePath of index2=.
Validating databases (splunkd validatedb) failed with code '1'.

Tags (1)
0 Karma
1 Solution

rsantoso_splunk
Splunk Employee
Splunk Employee

There is Index db path collision check for summaryHomePath starting from version 7.2.X

Possible affect to customers:
Any customer that has not configured with summaryHomePath or just configured with volume referencing for any index, I.e homePath = volume:hot at downward 7.2.x version

Symptom:
Indexer won’t be able to start after upgrade Or bundle push for indexes.conf change without the required configuration.

Error:
Problem parsing indexes.conf: Cannot load IndexConfig: index= Path=$SPLUNK_HOME/INDEX_NAME/summary given as value of param=homePath collides with value of param2=summaryHomePath of index2=

Reason:
Every index is going to use same summary index path(location).

To fix the issue:
Adding summaryHomePath = volume:hot/$_index_name/summary to every index configuration.

Please see our doc:
https://docs.splunk.com/Documentation/Splunk/latest/Admin/Indexesconf

summaryHomePath =

  • It is recommended that you specify the path with the following syntax:
    summaryHomePath = $SPLUNK_DB/$_index_name/summary
    At runtime, Splunk expands "$_index_name" to the name of the index. For example,
    if the index name is "newindex", summaryHomePath becomes "$SPLUNK_DB/newindex/summary".

  • May contain a volume reference (see volume section below) in place of $SPLUNK_DB.

  • Volume reference must be used if data retention based on data size is desired.

  • CAUTION: Path must be writable.

  • If not specified, Splunk creates a directory 'summary' in the same location as homePath

View solution in original post

rsantoso_splunk
Splunk Employee
Splunk Employee

There is Index db path collision check for summaryHomePath starting from version 7.2.X

Possible affect to customers:
Any customer that has not configured with summaryHomePath or just configured with volume referencing for any index, I.e homePath = volume:hot at downward 7.2.x version

Symptom:
Indexer won’t be able to start after upgrade Or bundle push for indexes.conf change without the required configuration.

Error:
Problem parsing indexes.conf: Cannot load IndexConfig: index= Path=$SPLUNK_HOME/INDEX_NAME/summary given as value of param=homePath collides with value of param2=summaryHomePath of index2=

Reason:
Every index is going to use same summary index path(location).

To fix the issue:
Adding summaryHomePath = volume:hot/$_index_name/summary to every index configuration.

Please see our doc:
https://docs.splunk.com/Documentation/Splunk/latest/Admin/Indexesconf

summaryHomePath =

  • It is recommended that you specify the path with the following syntax:
    summaryHomePath = $SPLUNK_DB/$_index_name/summary
    At runtime, Splunk expands "$_index_name" to the name of the index. For example,
    if the index name is "newindex", summaryHomePath becomes "$SPLUNK_DB/newindex/summary".

  • May contain a volume reference (see volume section below) in place of $SPLUNK_DB.

  • Volume reference must be used if data retention based on data size is desired.

  • CAUTION: Path must be writable.

  • If not specified, Splunk creates a directory 'summary' in the same location as homePath

Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...