Splunk Search

Where is tsidx created?

rroberts
Splunk Employee
Splunk Employee

If I run :

1.index=_* | fields action | tscollect namespace=myaction ...(creates tsidx file)

2.The myaction namespace will be created under $SPLUNK_HOME/var/lib/splunk/tsidxstats/myaction

3.| tstats count from myaction groupby action ...(read tsidx file)

However, if I don't use a namespace value where does the tsidx get created?

Tags (2)
1 Solution

rroberts
Splunk Employee
Splunk Employee

Found it looks like it will be created under :

/opt/home/rick/splunk/var/run/splunk/dispatch/1380485760.325/tsidxstats

View solution in original post

rroberts
Splunk Employee
Splunk Employee

Found it looks like it will be created under :

/opt/home/rick/splunk/var/run/splunk/dispatch/1380485760.325/tsidxstats

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...