splunk / splunk-platform-automator

Ansible framework providing a fast and simple way to spin up complex Splunk environments.
Apache License 2.0
117 stars 45 forks source link

Index splunklogger missing on org_all_indexes #11

Closed aleoliva closed 4 years ago

aleoliva commented 4 years ago

Describe the bug (This issue is not critical) The index splunklogger is missing in org_all_indexes therefore its path is set to default, although volumes are setup on Splunkenizer:

$ splunk btool indexes list splunklogger --debug | egrep -w 'coldPath|homePath'
/opt/splunk/etc/system/default/indexes.conf              coldPath = $SPLUNK_DB/splunklogger/colddb
/opt/splunk/etc/system/default/indexes.conf              coldPath.maxDataSizeMB = 0
/opt/splunk/etc/system/default/indexes.conf              homePath = $SPLUNK_DB/splunklogger/db
/opt/splunk/etc/system/default/indexes.conf              homePath.maxDataSizeMB = 0

To Reproduce \

Expected behavior The app org_all_indexes should include this Stanza entry, on its path _org_allindexes/local/indexes.conf:

[splunklogger]
homePath   = volume:hot/splunklogger/db
coldPath   = volume:cold/splunklogger/colddb
thawedPath = $SPLUNK_DB/splunklogger/thaweddb

Screenshots \

Desktop (please complete the following information):

Additional context \

splunkenizer commented 4 years ago

This index is not needed anymore. Please see the comment in /opt/splunk/etc/system/default/indexes.conf:

# this index has been removed in the 4.1 series, but this stanza must be
# preserved to avoid displaying errors for users that have tweaked the index's
# size/etc parameters in local/indexes.conf.
#
[splunklogger]
homePath   = $SPLUNK_DB/splunklogger/db
coldPath   = $SPLUNK_DB/splunklogger/colddb
thawedPath = $SPLUNK_DB/splunklogger/thaweddb
disabled = true