Deployment Architecture

Indexes.conf

shawno
New Member

I'm trying to source what indexes.conf is being utilized for each index; for example, I have an index called Web. What I'd like to configure is the total max size of 275GB for that index using a retirement and archiving policy (maxTotalDataSizeMB). But I don't know what index applies to what Indexes.conf (several are listed). Further, can I set up a different index to use as indexes.conf (not the default)?

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi shawno,

you can use the following Splunk CLI command:

 $SPLUNK_HOME/bin/splunk btool indexes list --debug 

This will show you the config file path so you will know where to change the settings.

And yes, you should use your own file in either $SPLUNK_HOME/etc/system/local or $SPLUNK_HOME/etc/apps/<yourappnamehere>/local.

Never change any setting in any file in $SPLUNK_HOME/etc/system/default.

Hope this helps ...

cheers, MuS

0 Karma

shawno
New Member

That didn't work!

./btool web list --debug
/opt/splunk/bin/splunkd: error while loading shared libraries: libjemalloc.so.2: cannot open shared object file: No such file or directory

0 Karma

shawno
New Member

Sorry posted it wrong; I used ./btool indexes list --debug

Also used the username splunk with ./btool indexes list --debug

/opt/splunk/bin/splunkd: error while loading shared libraries: libjemalloc.so.2: cannot open shared object file: No such file or directory

0 Karma

micahkemp
Champion

The command listed was ./splunk btool, not btool.

The btool command, despite having a binary right next to the splunk binary, has to be called from splunk, not directly.

MuS
SplunkTrust
SplunkTrust

you are not using the command I posted and most likely you are doing it not as the splunk user. Switch user to the Splunk user account (in most cases splunk) and run the correct command as posted 😉

0 Karma

shawno
New Member

./btool indexes list --debug

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...