Hi guys,
Here is quickly the situation:
When we upload our new .csv files by putting them into our folder /tmp/qualys, they are well indexed by the Indexer and our Dashboard show us what we want.
Our issue is: when on the deployment-server we run ./splunk reload deploy-server
After the reboot of the Indexer the index qualys is empty. So we loose our data previously indexed.
My tests:
So I'm open to any suggestion.
Thanks.
OK that was really stupid:
The parameter in indexes.conf: maxVolumeDataSizeMB for the entire volume was as big as the size of 1 index.
So that triggered the rolling data to frozen.
Now fixed.
OK that was really stupid:
The parameter in indexes.conf: maxVolumeDataSizeMB for the entire volume was as big as the size of 1 index.
So that triggered the rolling data to frozen.
Now fixed.
Thanks Greg,
The problem happened recently, I just capture an interesting log and based on the result I think the problem comes from:
[volume:primary]
path = /index
maxVolumeDataSizeMB = 5000
maxVolumeDataSizeMB = 5000
I put the size of my volume and reload the app.
I 'll gave a feedback if it's solve the problem.
Can you clarify the "index is empty"? Exactly what command are you executing to determine the index is empty?
Once its indexed, unless the index on disk is being blown away somehow, you should not lose any data. However, if you are using a lookuptable, thats another story.