Deployment Architecture

In trying to create coldToFrozenDir, has anyone seen the following "load IndexConfig" error?

sreejith2k2
Explorer

I am trying to create coldToFrozenDir on one of my network indexes. I am trying to do this in the Development environment before going to production environment.

[volume:frozen]
path = /opt/frozen/network

[network]
homePath = volume:primary/network/db
coldPath = volume:primary/network/colddb
thawedPath = $SPLUNK_DB/network/thaweddb
coldToFrozenDir = volume:frozen/network/frozendb
maxTotalDataSizeMB = 55000
frozenTimePeriodInSecs = 7776000

But, I am getting the following error —

Problem parsing indexes.conf: Cannot load IndexConfig: Cannot create index 'network':path of coldToFrozenDir must be absolute ('volume:frozen/network/frozendb')
Validating databases (splunkd validatedb) failed with code '1'. If you cannot resolve the issue(s) above after consulting documentation, please file a case online at   http://www.splunk.com/page/submit_issue

I've have even tried specifying path with no luck -

coldToFrozenDir = /opt/frozen/network

I am getting the same error. It's on the same file system

0 Karma

horsefez
Motivator

Does the splunk user has sufficient permissions to create a directory at that location?

0 Karma

sreejith2k2
Explorer

yes he has.. I have cross checked it.. Also I re-ran chown command as well.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...