I was told from support to run ./splunk diag and i receive the following:
./splunk diag
Ensuring clean temp dir...
Selected diag name of: diag-beefysup01-2011-04-12
Starting splunk diag...
The index splunklogger does not have a value set for homePath, this is unusual.
The index splunklogger does not have a value set for coldPath, this is unusual.
The index splunklogger does not have a value set for thawedPath, this is unusual.
Copying Splunk configuration files...
Copying Splunk log files...
Copying index worddata, and bucket info files...
The index splunklogger does not have a value set for homePath, this is unusual.
The index splunklogger does not have a value set for coldPath, this is unusual.
The index splunklogger does not have a value set for thawedPath, this is unusual.
Copying Splunk log files in the dispatch dir...
Creating archive file...
Cleaning up...
Splunk diagnosis file created: /home/gzaimi/splunk418/diag-beefysup01-2011-04-12.tar.gz
Why is this happening, what does it mean?
.gz
These errors are benign and are occurring because of an orphaned stanza for the legacy "splunklogger" index in $SPLUNK_HOME/etc/system/default/indexes.conf :
# this index has been removed in the 4.1 series, but this stanza must be
# preserved to avoid displaying errors for users that have tweaked the index's
# size/etc parameters in local/indexes.conf.
[splunklogger]
disabled = true
The goal of this stanza is to disable the "splunklogger" index which has been deprecated for a while. Splunk diag is a little bit anal about index stanzas that fail to include non-optional parameters such as "homePath", "coldPath" or "thawedPath" which is why you are seeing this error.
The easiest way to suppress this error would be to modify the [splunklogger] stanza in $SPLUNK_HOME/etc/system/default/indexes.conf (or $SPLUNK_HOME/etc/system/local/indexes.conf if you want this to be upgrade-resilient) as follows :
# this index has been removed in the 4.1 series, but this stanza must be
# preserved to avoid displaying errors for users that have tweaked the index's
# size/etc parameters in local/indexes.conf.
[splunklogger]
disabled = true
homePath = $SPLUNK_DB/splunklogger/db
coldPath = $SPLUNK_DB/splunklogger/colddb
thawedPath = $SPLUNK_DB/splunklogger/thaweddb
In all likelihood, this minor cosmetic error will be fixed in a future release.
These errors are benign and are occurring because of an orphaned stanza for the legacy "splunklogger" index in $SPLUNK_HOME/etc/system/default/indexes.conf :
# this index has been removed in the 4.1 series, but this stanza must be
# preserved to avoid displaying errors for users that have tweaked the index's
# size/etc parameters in local/indexes.conf.
[splunklogger]
disabled = true
The goal of this stanza is to disable the "splunklogger" index which has been deprecated for a while. Splunk diag is a little bit anal about index stanzas that fail to include non-optional parameters such as "homePath", "coldPath" or "thawedPath" which is why you are seeing this error.
The easiest way to suppress this error would be to modify the [splunklogger] stanza in $SPLUNK_HOME/etc/system/default/indexes.conf (or $SPLUNK_HOME/etc/system/local/indexes.conf if you want this to be upgrade-resilient) as follows :
# this index has been removed in the 4.1 series, but this stanza must be
# preserved to avoid displaying errors for users that have tweaked the index's
# size/etc parameters in local/indexes.conf.
[splunklogger]
disabled = true
homePath = $SPLUNK_DB/splunklogger/db
coldPath = $SPLUNK_DB/splunklogger/colddb
thawedPath = $SPLUNK_DB/splunklogger/thaweddb
In all likelihood, this minor cosmetic error will be fixed in a future release.
As of 4.1.7 and up, $SPLUNK_HOME/etc/system/default/indexes.conf now defaults to disable the splunklogger index as:
[splunklogger]
disabled = true