collections.conf
The following are the spec and example files for collections.conf
.
collections.conf.spec
# Version 7.0.0 # # This file configures the KV Store collections for a given app in Splunk. # # To learn more about configuration files (including precedence) please see # the documentation located at # http://docs.splunk.com/Documentation/Splunk/latest/Admin/Aboutconfigurationfiles
[<collection-name>]
enforceTypes = true|false * Indicates whether to enforce data types when inserting data into the collection. * When set to true, invalid insert operations fail. * When set to false, invalid insert operations drop only the invalid field. * Defaults to false. field.<name> = number|bool|string|time * Field type for a field called <name>. * If the data type is not provided, it is inferred from the provided JSON data type. accelerated_fields.<name> = <json> * Acceleration definition for an acceleration called <name>. * Must be a valid JSON document (invalid JSON is ignored). * Example: 'acceleration.foo={"a":1, "b":-1}' is a compound acceleration that first sorts 'a' in ascending order and then 'b' in descending order. * If multiple accelerations with the same definition are in the same collection, the duplicates are skipped. * If the data within a field is too large for acceleration, you will see a warning when you try to create an accelerated field and the acceleration will not be created. * An acceleration is always created on the _key. * The order of accelerations is important. For example, an acceleration of { "a":1, "b":1 } speeds queries on "a" and "a" + "b", but not on "b" lone. * Multiple separate accelerations also speed up queries. For example, separate accelerations { "a": 1 } and { "b": 1 } will speed up queries on "a" + "b", but not as well as a combined acceleration { "a":1, "b":1 }. * Defaults to nothing (no acceleration). profilingEnabled = true|false * Indicates whether to enable logging of slow-running operations, as defined in 'profilingThresholdMs'. * Defaults to false. profilingThresholdMs = <zero or positive integer> * The threshold for logging a slow-running operation, in milliseconds. * When set to 0, all operations are logged. * This setting is only used when 'profilingEnabled' is true. * This setting impacts the performance of the collection. * Defaults to 1000. replicate = true|false * Indicates whether to replicate this collection on indexers. When false, this collection is not replicated, and lookups that depend on this collection will not be available (although if you run a lookup command with 'local=true', local lookups will still be available). When true, this collection is replicated on indexers. * Defaults to false. replication_dump_strategy = one_file|auto * Indicates how to store dump files. When set to one_file, dump files are stored in a single file. When set to auto, dumps are stored in multiple files when the size of the collection exceeds the value of 'replication_dump_maximum_file_size'. * Defaults to auto. replication_dump_maximum_file_size = <unsigned integer> * Specifies the maximum file size (in KB) for each dump file when 'replication_dump_strategy=auto'. * If this value is larger than 'concerningReplicatedFileSize', which is set in distsearch.conf, the value of 'concerningReplicatedFileSize' will be used instead. * KV Store does not pre-calculate the size of the records that will be written to disk, so the size of the resulting files can be affected by the 'max_rows_in_memory_per_dump' setting from 'limits.conf'. * Defaults to 10240KB. type = internal_cache|undefined * Indicates the type of data that this collection holds. * When set to 'internal_cache', changing the configuration of the current instance between search head cluster, search head pool, or standalone will erase the data in the collection. * Defaults to 'undefined'. * For internal use only.
collections.conf.example
# Version 7.0.0 # # The following is an example collections.conf configuration. # # To use one or more of these configurations, copy the configuration block # into collections.conf in $SPLUNK_HOME/etc/system/local/. You must restart # Splunk to enable configurations. # # To learn more about configuration files (including precedence) please see # the documentation located at # http://docs.splunk.com/Documentation/Splunk/latest/Admin/Aboutconfigurationfiles [mycollection] field.foo = number field.bar = string accelerated_fields.myacceleration = {"foo": 1, "bar": -1}
checklist.conf | commands.conf |
This documentation applies to the following versions of Splunk® Enterprise: 7.0.0
Feedback submitted, thanks!