Deployment Architecture

$_Index_name Variable Need To Know How To Setup Correctly

gregbaskin
Explorer

I'm working on trying to figure out how to get the index name to show up correctly instead of placing the files in a folder named '$_index_name' on my backup folder on the indexer.

On the Cluster Master under $Splunk_Home/etc/master-apps/local/indexes.conf I have the following:

[default]
homePath = volume:primary/$_index_name/db --works correctly with variable
coldPath = volume:cold/$_index_name/db --works correctly with variable
coldToFrozenDir = /'foldername'/frozen/$_index_name --DOES NOT WORK CORRECTLY -'foldername' is irrelevant here and just a name of a folder.

Now, on the Indexer, where I want the data to go is to /'foldername'/frozen/

It's getting there on the Indexer however, it's coming in as /'foldername'/frozen/$_index_name/db

I'm running into the issue that this '$_index_name' is not translating to the index name and has created a folder named '$_index_name' instead of the actual index name.

Looking for a little guidance and solution to this challenge.

  1. Should I NOT use the environment variable and use only the absolute path on the 'coldToFrozenDir'?
  2. This is only on 1 indexer which I want to roll down to about 9 more so I'm looking for the best practice.
  3. I've looked here before posting this question: https://answers.splunk.com/answers/108178/index-name-variable-to-use-in-all-index-paths.html

Any insight will be helpful moving forward.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

$_index_name is not an environment variable. It's a Splunk shortcut available only for the hotPath, coldPath, and summaryHomePath attributes.

---
If this reply helps you, Karma would be appreciated.

gregbaskin
Explorer

Ok, thanks. Is there a better way to set this up where it creates the 'index name' instead of the folder like it is doing with the databases under that folder?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Copy-and-paste the index name from the stanza to the attribute.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...