When creating a diag, splunk complains about splunklogger index not having paths for home/cold/thawedPath

[Genti]

I was told from support to run ./splunk diag and i receive the following:

./splunk diag
Ensuring clean temp dir...
Selected diag name of: diag-beefysup01-2011-04-12
Starting splunk diag...
The index splunklogger does not have a value set for homePath, this is unusual.
The index splunklogger does not have a value set for coldPath, this is unusual.
The index splunklogger does not have a value set for thawedPath, this is unusual.
Copying Splunk configuration files...
Copying Splunk log files...
Copying index worddata, and bucket info files...
The index splunklogger does not have a value set for homePath, this is unusual.
The index splunklogger does not have a value set for coldPath, this is unusual.
The index splunklogger does not have a value set for thawedPath, this is unusual.
Copying Splunk log files in the dispatch dir...
Creating archive file...
Cleaning up...
Splunk diagnosis file created: /home/gzaimi/splunk418/diag-beefysup01-2011-04-12.tar.gz

Why is this happening, what does it mean?
.gz

[hexx · Accepted solution]

These errors are benign and are occurring because of an orphaned stanza for the legacy "splunklogger" index in $SPLUNK_HOME/etc/system/default/indexes.conf :

 # this index has been removed in the 4.1 series, but this stanza must be
 # preserved to avoid displaying errors for users that have tweaked the index's
 # size/etc parameters in local/indexes.conf.
 [splunklogger]
 disabled = true

The goal of this stanza is to disable the "splunklogger" index which has been deprecated for a while. Splunk diag is a little bit anal about index stanzas that fail to include non-optional parameters such as "homePath", "coldPath" or "thawedPath" which is why you are seeing this error.

The easiest way to suppress this error would be to modify the [splunklogger] stanza in $SPLUNK_HOME/etc/system/default/indexes.conf (or $SPLUNK_HOME/etc/system/local/indexes.conf if you want this to be upgrade-resilient) as follows :

 # this index has been removed in the 4.1 series, but this stanza must be
 # preserved to avoid displaying errors for users that have tweaked the index's
 # size/etc parameters in local/indexes.conf.
 [splunklogger]
 disabled = true
 homePath = $SPLUNK_DB/splunklogger/db
 coldPath = $SPLUNK_DB/splunklogger/colddb
 thawedPath = $SPLUNK_DB/splunklogger/thaweddb

In all likelihood, this minor cosmetic error will be fixed in a future release.

[Ellen]

As of 4.1.7 and up, $SPLUNK_HOME/etc/system/default/indexes.conf now defaults to disable the splunklogger index as:

[splunklogger]
disabled = true