Deployment Architecture

Cleaning Indexes not working

johnness
Explorer

Hi SplunkBase
Trying out the free version (4.2.4) on my Windows 7 64bit client and as you can guess, hit an index limit (500mb). I wanted to run the clean commnand but get the following message window when running the following command(s):

C:\Program Files\Splunk\bin>.\splunk stop << works !
C:\Program Files\Splunk\bin>.\splunk help clean << popup

Popup Window:
Title: C:\Program Files\Splunk\bin\splunk.exe

Could not look up HOMEPATH variable. Auth tokens cannot be cached.

Any help appreciated.

Regads, John

Tags (3)
1 Solution

MHibbin
Influencer

I don't think you need the ".\" I normally just cd to the bin directory, as you have done, and then run a command like...

C:\>Program Files\Splunk\bin>splunk.exe clean eventdata -index <index name>

So you are looking for

C:\>Program Files\Splunk\bin>splunk.exe help clean

To stop the command opening in a popup, and I think this will help with the HomePath issue, as I assume you installed Splunk with admin priviledges, you should also run the CMD prompt as Administrator...

"Start" >> Type CMD in search bar >> Right-click CMD >> "Run as administrator"

You can check your HOMEPATH using the following command (not to be confused with the homePath variable used in Splunk)...

>SET HOMEPATH

Mine on my dev laptop is...

HOMEPATH=\Users\Matt

Hope this helps

View solution in original post

johnness
Explorer

on the elevated Command Prompt enter

SET HOMEPATH=C:\Temp

And because you'll get an error message about the missing HOMEDRIVE just

SET HOMEDRIVE=C:

And all is well.

johnness
Explorer

Hi MHibbin

Your answer was only part of the solution. I still can't get used to the fact that starting a command prompt as "Administrator" is not the same as opening a Command Prompt with an administrative account via:

runas /user:domain\user * cmd

Your answer solved the popup problem but not the HOMEPATH issue. Following is the Command Prompt output after using splunk help clean

C:\Program Files\Splunk\bin>splunk help clean

Could not look up HOMEPATH variable. Auth tokens cannot be cached.

An error occurred: Could not determine user's home directory because HOMEPATH
shell variable is not set.

There are various homepath variables defined in the C:\Program Files\Splunk\etc\system\default\indexes.conf file, but what to change?
I currently have no indexes.conf file in the C:\Program Files\Splunk\etc\system\local directory, because I am still using the basic installation.

And I have no Homepath in my environment variables.

Thanks for the first hint. Looking forward to the complete solution.

Regards, John

0 Karma

MHibbin
Influencer

I don't think you need the ".\" I normally just cd to the bin directory, as you have done, and then run a command like...

C:\>Program Files\Splunk\bin>splunk.exe clean eventdata -index <index name>

So you are looking for

C:\>Program Files\Splunk\bin>splunk.exe help clean

To stop the command opening in a popup, and I think this will help with the HomePath issue, as I assume you installed Splunk with admin priviledges, you should also run the CMD prompt as Administrator...

"Start" >> Type CMD in search bar >> Right-click CMD >> "Run as administrator"

You can check your HOMEPATH using the following command (not to be confused with the homePath variable used in Splunk)...

>SET HOMEPATH

Mine on my dev laptop is...

HOMEPATH=\Users\Matt

Hope this helps

MHibbin
Influencer

I changed the formatting, and added the part about HOMEPATH, I too had a similar issue like this previously (and had forgotten about about the SET HOMEPATH part, however I had edited my answer before seeing your answer :0) ).

0 Karma

samiulamin123
Engager

Hi MHibbin,

Can you please explain the homepath issue? I did not see any mention of it in splunk doc regarding cleaning and deleting index.

Thanks and regards,

Samiul

0 Karma

johnness
Explorer

Puzzled. Did your answer change? Ok you get full marks.

I set HOMEPATH to C:\Temp and the then missing HOMEDRIVE to C: which seems to have solved my issue.

0 Karma

johnness
Explorer

Hi MHibbin

Your answer was part of the solution. I still can't get used to the fact that starting a prompt as "Administrator" is not the same as opening a Command Prompt with an administrative account via:

runas /user:domain\user * cmd

Your answer solved the popup problem but not the HOMEPATH issue. Following is the output after using splunk help clean

C:\Program Files\Splunk\bin>splunk help clean

Could not look up HOMEPATH variable. Auth tokens cannot be cached.

An error occurred: Could not determine user's home directory because HOMEPATH shell variable is not set.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...