Splunk® Enterprise

Admin Manual

Download manual as PDF

This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF

collections.conf

The following are the spec and example files for collections.conf.

collections.conf.spec

#   Version 6.2.0 
#
# This file configures the KV Store collections for a given app in Splunk. 
#
# To learn more about configuration files (including precedence) please see the documentation
# located at http://docs.splunk.com/Documentation/Splunk/latest/Admin/Aboutconfigurationfiles


[<collection-name>]

enforceTypes = true|false
* Indicates whether to enforce data types when inserting data into the collection.
* When set to true, invalid insert operations fail.
* When set to false, invalid insert operations drop only the invalid field.
* Defaults to false.

field.<name> = number|bool|string|time
* Field type for a field called <name>.
* If the data type is not provided, it is inferred from the provided JSON data type.

accelerated_fields.<name> = <json>
* Acceleration definition for an acceleration called <name>.
* Must be a valid JSON document (invalid JSON is ignored).
* Example: 'acceleration.foo={"a":1, "b":-1}' is a compound acceleration that first 
  sorts 'a' in ascending order and then 'b' in descending order.
* If multiple accelerations with the same definition are in the same collection, 
  the duplicates are skipped.
* If the data within a field is too large for acceleration, you will see a warning
  when you try to create an accelerated field and the acceleration will not be created.
* An acceleration is always created on the _key.
* The order of accelerations is important. For example, an acceleration of { "a":1, "b":1 } 
  speeds queries on "a" and "a" + "b", but not on "b" alone.
* Multiple separate accelerations also speed up queries. For example, separate accelerations 
  { "a":1 } and { "b": 1 } will speed up queries on "a" + "b", but not as well as 
  a combined acceleration { "a":1, "b":1 }.
* Defaults to nothing (no acceleration).

profilingEnabled = true|false
* Indicates whether to enable logging of slow-running operations, as defined in 'profilingThresholdMs'.
* Defaults to false.

profilingThresholdMs = <zero or positive integer>
* The threshold for logging a slow-running operation, in milliseconds. 
* When set to 0, all operations are logged. 
* This setting is only used when 'profilingEnabled' is true. 
* This setting impacts the performance of the collection. 
* Defaults to 100.

collections.conf.example

#   Version 6.2.0 
#
# The following is an example collections.conf configuration.
#
# To use one or more of these configurations, copy the configuration block into
# collections.conf in $SPLUNK_HOME/etc/system/local/. You must restart Splunk to enable configurations.
#
# To learn more about configuration files (including precedence) please see the documentation 
# located at http://docs.splunk.com/Documentation/Splunk/latest/Admin/Aboutconfigurationfiles

[mycollection]

field.foo = number
field.bar = string
accelerated_fields.myacceleration = {"foo": 1, "bar": -1}

PREVIOUS
authorize.conf
  NEXT
commands.conf

This documentation applies to the following versions of Splunk® Enterprise: 6.2.0


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters