Splunk Search

Where are the tsidx files generated by tscollect command written to?

the_wolverine
Champion

I can't seem to find information in the documentation as to where I can locate the generated tsidx files from my tscollect run are written to when I specify a namespace.

0 Karma

tfletcher_splun
Splunk Employee
Splunk Employee

The tsidx namespaces generated by tscollect are ALWAYS stored on the search head that executes the tscollect search. They cannot be forwarded or replicated to the indexers. Per indexes.conf.spec you will see the location of the files called out by indexes.conf. You can make things work in search head pooled environments by making the tsidxStatsHomePath property point to some shared storage but it has a performance penalty. Without shared storage you cannot make tscollect based namespaces work in a search head pool or cluster and you will receive no scale benefit from map-reduce.

Data model acceleration works very differently and does keep the accelerated namespaces along side the originating indexes on the indexer tier.

Please see indexes.conf.spec for more details on tsidxStatsHomePath.

GeorgeStarkey
Path Finder

Is this still an accurate statement about the tsidx/tscollect artifacts not replicating on a search head cluster?

0 Karma

somesoni2
Revered Legend

Yes... the tsidexstats is still created only on SH and is not replicated to other SHC members.

0 Karma

jayannah
Builder

If namespace is provided, the tsidx files are written to a directory of that name under the main tsidxstats directory (that is, within $SPLUNK_DB/tsidxstats). These namespaces can be written to multiple times to add new data. If namespace is not provided, the files are written to a directory within the job directory of that search, and will live as long as the job does. This namespace location is also configurable in indexes.conf, with the attribute tsidxStatsHomePath.

http://docs.splunk.com/Documentation/Splunk/6.2.1/SearchReference/Tscollect

the_wolverine
Champion

Hi, thanks for your response.
I read the same documentation but I still can't tell where that location is and I'm unable to find it.

Is it on one of the indexers?
Is it on the search head? If so, which one? The SH that I ran tscollect?
(What if I'm logged in to SSO VIP -- I won't know which one in that case.)

If I'm using SH_POOLING, is it located somewhere else?

The documentation is too vague.

0 Karma

jayannah
Builder

@the_wolverine - tscollect information are stored in Indexers.

0 Karma

mcronkrite
Splunk Employee
Splunk Employee

Do you use replication in your indexing tier? But in general the indexers have the tsidxstats e.g. $Splunk_DB$/tsidxstats for the index that was involved in the transaction.

0 Karma
Get Updates on the Splunk Community!

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...

Splunk and Fraud

Watch Now!Watch an insightful webinar where we delve into the innovative approaches to solving fraud using the ...