indexes.conf

indexes.conf

Indexes.conf controls index settings including archiving, retirement, path and tuning parameters.

To edit configurations for your local Splunk server, use $SPLUNK_HOME/etc/system/local/indexes.conf.

You can create this file by copying examples from $SPLUNK_HOME/etc/system/README/indexes.conf.example.

Never edit files in the default directory $SPLUNK_HOME/etc/system/default, as your changes may be overwritten in an upgrade.

indexes.conf.spec

# Copyright (C) 2005-2008 Splunk Inc.  All Rights Reserved.  Version 3.0 
#
# This file contains all possible options for an indexes.conf file.  Use this file to configure 
# Splunk's indexes and their properties.
#
# There is an indexes.conf in $SPLUNK_HOME/etc/system/default/.  To set custom configurations, 
# place an indexes.conf in $SPLUNK_HOME/etc/system/local/. For examples, see 
# indexes.conf.example. You must restart Splunk to enable configurations.
#
# To learn more about configuration files (including precedence) please see the documentation 
# located at http://www.splunk.com/base/Documentation/latest/Admin/HowDoConfigurationFilesWork.
#
# CAUTION:  You can drastically affect your Splunk installation by changing these settings.  
# Consult technical support (support@splunk.com) if you are not sure how to configure this file.
#
# DO NOT change the attribute QueryLanguageDefinition without consulting technical support.
#******************************************************************************	
# GLOBAL OPTIONS
# These options affect every index
#******************************************************************************	

sync = <integer>
* The index processor syncs events every <integer> number of events.
* Must be non-negative.
* Set to 0 to disable.
* Defaults to 0.

defaultDatabase = <database name>
* If no index is specified during search, Splunk searches default database. 
* Also the database displays by default on the homepage.
* Defaults to main.
  	
queryLanguageDefinition = <path to file>
* The path to the search language definition file.
* DO NOT EDIT THIS SETTING.
* Defaults to $SPLUNK_HOME/etc/searchLanguage.xml.

blockSignatureDatabase = <database name>
* This is the database that stores block signatures of events.
* Defaults to _blocksignature.


#******************************************************************************
# PER INDEX OPTIONS
# These options may be set under an [$INDEX] entry 
#******************************************************************************

disabled = true | false
* Toggle your index entry off and on.
* Set to true to disble an index.
* Defaults to false.

homePath = <path on server>
* The path that contains the hot and warm databases and fields for the index. 
* Splunkd keeps a file handle open for warm databases at all times .
* CAUTION: Path MUST be writable.

coldPath = <path on server>
* The path that contains the cold databases for the index. 
* Cold databases are opened as needed when searching.
* CAUTION: Path MUST be writable.
   	
thawedPath = <path on server>
* The path that contains the thawed (resurrected) databases for the index.
# The following options can be set either per index or at the top of the file as defaults for all indexes.
# Defaults set at the top of the file are overridden if set on a per-index basis.

maxWarmDBCount = <integer>
* The maximum number of warm DB_N_N_N directories.
* All warm DBs are in the <homePath> for the index. 
* Warm DBs are kept in open state.
* Defaults to 300.

maxColdDBCount = <integer>
* The maximum number of open cold databases at any given time.
* THIS IS NOT the total number of cold databases. 
* During search, splunkd keeps an LRU cache of all open cold DBs; this number controls the size of that cache.
* Defaults to 10.

maxTotalDataSizeMB = <integer>
* The maximum size of an index (in MB). 
* If an index grows larger, the oldest data is frozen.
* Defaults to 500000.

rotatePeriodInSecs = <integer>
* Frequency (in seconds) to check if a new hot DB needs to be created.
* Also the frequency to check if there are any cold DBs that need to be frozen.
* Defaults to 60.

frozenTimePeriodInSecs = <integer>
* Number of seconds after which indexed data rolls to frozen.
* If you do not specify a coldToFrozenScript, this data is erased.
* IMPORTANT: Every event in the DB must be older than frozenTimePeriodInSecs before it will roll.
* frozenTimePeriodInSecs will be frozen the next time splunkd checks.
* Defaults to 188697600.

warmToColdScript = <script> 
* Specify a script to run when moving data from warm to cold. 
* The script must accept two variables:
 * First: the warm directory to be rolled to cold.
 * Second: the destination in the cold path.
* You only need to set this if you store warm and cold DBs on separate partitions.
* Please contact Splunk Support if you need help configuring this setting.
* Defaults to empty.

coldToFrozenScript = <script>
* Specify an archiving script by changing <script>.
* Splunk ships with two default archiving scripts (or create your own):
 * compressedExport.sh - Export with tsidx files compressed as gz.
 * flatfileExport.sh - Export as a flat text file.
 * Define <$script> paths relative to $SPLUNK_HOME/bin
* WINDOWS users use this notation:
  coldToFrozenScript = <script> "$DIR" 
 * <script> can be either compressedExport.bat or flatfileExport.bat

compressRawdata = true | false
* If set to true, Splunk writes raw data out as compressed gz files.
* If set to false, Splunk will write data to an uncompressed raw file.
* Defaults to true.

maxConcurrentOptimizes = <integer>
* The number of concurrent optimize processes that can be run against the hot DB.
* This number should be increased if: 
 1. There are always many small tsidx files in the hot DB.
 2. After rolling, there are many tsidx files in warm or cold DB.

waitForOptimize = <integer>
* Wait to roll until optimize processes finish.
* If you set to 0, Splunk does not wait for the optimize to finish before rolling.
* If you are seeing a big pause in indexing or searching during rolling set this to 0.

maxDataSize = <integer>
* The maximum size in MBs of the hot DB.
* The hot DB will grow to this size before it is rolled out to warm.
* Do not increase the default setting unless Splunk is running in 64bit mode.
* Defaults to 750.
     
indexThreads = <integer>
* The number of extra threads to use during indexing. 
* This number should not be set higher than the number of processors in the box minus one. 
* If splunkd is also doing parsing and aggregation, the number should be lower than the total number of processors minus two.
* Defaults to 0.

maxMemMB = <integer>
* The amount of memory to allocate for indexing. 
* This amount of memory will be allocated PER INDEX THREAD.
* OR If indexThreads is set to 0, once per index.
* IMPORTANT:  Calculate this number carefully.
 * splunkd will crash if you set this number higher than what is available.
* Defaults to 50.
   
blockSignSize = <integer>
* Controls how many events make up a block for block signatures. 
* If it is set to 0 block signing is disabled for this index.
* Defaults to 0.
   
#******************************************************************************    
# Advanced memory tuning parameters.  Do not alter these without contacting Splunk Support. 
# Use maxMemMB to control memory usage.
#******************************************************************************
maxTermChars = <integer>
* Defaults to 2097152.
   
maxTerms = <integer>
* Defaults to 131072.
 
maxPostings = <integer>
* Defaults to 2097152.
 
maxValues = <integer>
* Defaults to 65536.

indexes.conf.example

# Copyright (C) 2005-2008 Splunk Inc.  All Rights Reserved.  Version 3.0 
#
# This file contains an example indexes.conf.  Use this file to configure indexing properties.
#
# To use one or more of these configurations, copy the configuration block into
# indexes.conf in $SPLUNK_HOME/etc/system/local/. You must restart Splunk to 
# enable configurations.
#
# To learn more about configuration files (including precedence) please see the documentation 
# located at http://www.splunk.com/base/Documentation/latest/Admin/HowDoConfigurationFilesWork.
#
# The following example sets up a new default index, called "hatch."
defaultDatabase = hatch
[hatch]
homePath   = $SPLUNK_DB/hatchdb/db
coldPath   = $SPLUNK_DB/hatchdb/colddb
thawedPath = $SPLUNK_DB/hatchdb/thaweddb
indexThreads = 1

# Max amount of physical memory (in megabytes) to use for a given index
maxMemMB = 200
maxDataSize = 10000

# The following example changes the default amount of space and memory Splunk's indexes use.
maxTotalDataSizeMB = 650000
maxMemMB = 75

# The following example changes the time data is kept around by default.
# It also sets an export script.  NOTE: You must edit this script to set export location before 
# running it.
maxWarmDBCount = 200
maxColdDBCount = 5
frozenTimePeriodInSecs = 432000
rotatePeriodInSecs = 30
coldToFrozenScript = /opt/bin/compressedExport.sh

• Was this topic useful?
• Post a comment