Splunk Search

In a distributed search environment, how to find out from which location it reading the configuration file of distsearch.conf ?

Hemnaath
Motivator

Hi All, Please let me know how to find out from which location splunk is reading the configuration file of distsearch.conf ?
I had tried the below btool command and got some out put but not sure whether this the way to search a particular configuration file in splunk.

./splunk cmd btool distsearch list --debug

thanks in advance.

Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

hi Hemnaath,
You can find it at $SPLUNK_HOME/etc/system/local/ as you can see in http://docs.splunk.com/Documentation/Splunk/6.5.1/admin/Distsearchconf
Every way ./splunk cmd btool distsearch list --debug runs.
Bye.
Giuseppe

Hemnaath
Motivator

how to find out from which location it reading the configuration file of indexes.conf file. Currently we are facing a space crunch in the PCI search head, on investigating we found that splunk internal index like
audit, access_summarydb is consuming more space almost 80GB of space is consumed by this two indexes.

Path
/opt/splunk/var/lib/splunk --> disk usage is almost 95%

my question is how to find out which is the active indexes.conf file from where these configuration files are read in the search head. Kindly let me know whether we can use this btool command to get this input.

./splunk cmd btool indexes list --debug

thanks in advance.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

The btool command with --debug option should be able to tell you which configuration files are being used by Splunk, for all conf files.

0 Karma

gcusello
SplunkTrust
SplunkTrust

hi Hemnaath,
about the disk space used for Splunk internal logs, you have to definire your policies and set according retention: e.g. i usually use 2 years for audit logs (that are few!) and a month (or less) for internal logs that are very large, because I usually don't use logs older than a month to debug a problem when I have.

About SHs' internal logs, it's a best practice to send all Splunk infrastructure servers internal logs (not only forwarders) to indexers, to have only one repository to debug problems and one point to configure.

About the active indexes.conf, probably there isn't only one active indexes.conf but there are one active configurations for each index from different indexes.conf files.
To understand which is the active settings for an index, as i said, you have to use btools command.

Bye.
Giuseppe

0 Karma

nnmiller
Contributor

Sounds like you are not forwarding your search head's internal logs to the indexers. This can cause performance issues on the search head in addition to consuming space.

Please have a look at the following docs page: http://docs.splunk.com/Documentation/Splunk/latest/DistSearch/Forwardsearchheaddata

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...