Reporting

indexer fails to create the report acceleration summary folders per index with custom location

mataharry
Communicator

Report acceleration is failing because splunk cannot create the folder for the summary (summaryHomePath ).
This seems linked to my custom homePaths.

It works for this index, and the folder /opt/splunk/var/lib/splunk/index1/summary is created.
[index1]
homePath=$SPLUNK_DB/index1/db
coldPath=$SPLUNK_DB/index1/colddb
thawedPath=$SPLUNK_DB/index1/thaweddb

It fails for this one, and no folder /summary is created.
[index2]
homePath=/index2db
coldPath=/index2_colddb
thawedPath=/index2_thaweddb

0 Karma
1 Solution

yannK
Splunk Employee
Splunk Employee

This is a known bug in splunk 5.* and 6.0
http://docs.splunk.com/Documentation/Splunk/6.0/ReleaseNotes/KnownIssues#Unsorted_issues

Summary folders (summaryHomePath) cannot be created if the homePath of the index is at the root of the filesystem, (homePath=D:\myindex or homePath=/myindex). The workaround is to create the folder manually. (SPL-71645)

The workarounds are :

  • to create the folder manually, and specify the summaryHomePath parameter in indexes.conf. Beware you do not want to have the summary as a subfolder of the homePath or coldPath.
  • Or to use folder architecture similar to the splunk one : homePath=/indexname/db

Or to use folder architecture similar to the splunk one : homePath=/indexname/db

see indexes.conf
summaryHomePath = <path on index server>
* An absolute path where transparent summarization results for data in this index
* should be stored. Must be different for each index and may be on any disk drive.
* If not specified it defaults to homePath/../summary/
* CAUTION: Path must be writable.
* May NOT contain a volume reference.
* Must restart splunkd after changing this parameter; index reload will not suffice.

View solution in original post

0 Karma

yannK
Splunk Employee
Splunk Employee

This is a known bug in splunk 5.* and 6.0
http://docs.splunk.com/Documentation/Splunk/6.0/ReleaseNotes/KnownIssues#Unsorted_issues

Summary folders (summaryHomePath) cannot be created if the homePath of the index is at the root of the filesystem, (homePath=D:\myindex or homePath=/myindex). The workaround is to create the folder manually. (SPL-71645)

The workarounds are :

  • to create the folder manually, and specify the summaryHomePath parameter in indexes.conf. Beware you do not want to have the summary as a subfolder of the homePath or coldPath.
  • Or to use folder architecture similar to the splunk one : homePath=/indexname/db

Or to use folder architecture similar to the splunk one : homePath=/indexname/db

see indexes.conf
summaryHomePath = <path on index server>
* An absolute path where transparent summarization results for data in this index
* should be stored. Must be different for each index and may be on any disk drive.
* If not specified it defaults to homePath/../summary/
* CAUTION: Path must be writable.
* May NOT contain a volume reference.
* Must restart splunkd after changing this parameter; index reload will not suffice.

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

New Learning Videos on Topics Most Requested by You! Plus This Month’s New Splunk ...

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...