Documentation: 3.3
|  Print Version Contents
This page last updated: 09/16/08 05:09pm

Create an index

Splunk ships with an index called main that, by default, holds all your events. Splunk with an Enterprise license lets you add an unlimited number of additional indexes. One of them serves as the default index for any input and search command that don't specify and index. You can add indexes via Splunk Web, Splunk's CLI or indexes.conf.

Splunk searches automatically look through the default index (by default, main) unless otherwise specified. If you have created a new index, or want to search in any index that is not default, you must specify the index in your search:

index=hatch userid=henry.galeSearch

This searches in the hatch index for the userid=henry.gale.

via Splunk Web

Note: To apply any changes that you make to the indexes, such as editing properties or adding a new index, you must restart Splunk. In Splunk Web, you can restart the Splunk server from Admin > Server: Control Server. Just click Restart Now.

create new index

The Admin > Indexes: Create Index page lets you define the properties for a new index. To create a new index, enter:

  • A name for the index.
  • The maximum size (in MB) of the hot database.
  • The maximum size (in MB) of the index.

Note: Index names must consist of only numbers, letters, periods, underscores, and dashes.

If you check Advanced settings, the list of properties expands. Advanced properties include:

  • The maximum number of search results.
  • The maximum number of warm database directories.
  • The maximum number of cold databases open at any given time.
  • The frequency that new hot database are to be created.
  • The frequency that cold databases are to be frozen.
  • The script and directory to archive the index's data.
  • The number of concurrently running optimize processes.
  • Whether to wait for optimize processes to finish or just kill them.
  • The number of extra threads to use during indexing.
  • The amount of memory (in MB) to allocate for indexing.
  • The number of events to make up a block for block signatures.

After setting the index's properties, click Add. Then, restart Splunk to save and apply your changes.

You can also edit an index at any time by clicking on the index name within the Indexes tab of the Admin section of Splunk Web. Properties that you cannot change are grayed out. To change these properties, use indexes.conf.

via Splunk's CLI

To use Splunk's CLI, navigate to the $SPLUNK_HOME/bin/ directory and use the ./splunk command. You can also add Splunk to your path and use the splunk command.

To add an index, first shutdown Splunk with splunk stop. Then navigate to Splunk's CLI. Then type:

# splunk add index [name]

Note: Do not use capital letters in your index name; this is a known problem that will be fixed.

The add index command brings you to a dialog session. Specify the configurations of your new index:

splunk add index hatch

Hit enter to accept the default values in parenthesis, or enter your own values.

via indexes.conf

Add a stanza to indexes.conf in $SPLUNK_HOME/etc/system/local. See configuration details and examples in indexes.conf.spec.

Delete an index

To remove any indexes you don't want, use indexes.conf or Splunk's CLI.

via indexes.conf

Remove the index stanza from indexes.conf. Custom indexes are in $SPLUNK_HOME/etc/system/local, or you application directory in $SPLUNK_HOME/etc/system/apps

via the CLI

You can also delete an index through the CLI.

# ./splunk remove index [name]

This command deletes the index from your Splunk instance.

Previous: Splunk data management    |    Next: Remove (delete) data

Comments

  1. Rick1: If you are unable to contact support you can start a thread on the forums (which is probably a better place for specific troubleshooting than the docs comments). In reading your last comment (9/14 @ 5:50pm) it sounds like you are adding your data to your alternate index but when you search in the GUI you aren't seeing anything. The GUI dashboards default to searching the "main" or "internal" index. If you want to search for data that is residing in an alternate index you will need specify index=myindexname at the beginning of your search. If you need dashboards that search across your other indexes you will need to create those. More information on creating dashboards can be found here: http://www.splunk.com/doc/latest/developer/DevDashboards
    Posted by m@ on Sep 15 2008, 11:22am

  2. @Rick1:

    Your last comment: I have cleaned up this page to make the syntax clear.

    Your other comments: I'll let Splunk Support know. You can also submit trouble tickets with them via a web form, or talk to them on IRC. Here's more info:

    http://www.splunk.com/support/174
    Posted by emma on Sep 14 2008, 11:11pm

  3. Refering to item 1 above.

    If I don't use -sourcetype, or I don't use -index, then it works, its using both in combination that fails.

    Rick
    Posted by Rick1 on Sep 14 2008, 7:02pm

  4. I have created my index, I have loaded some data into in with :-
    /opt/splunk/bin/splun add monitor /mydata -hostname myhost -sourcetype mysourcetype -index myindexname $AUTH

    When I go into the GUI admin dashboard, I can see my data having been loaded as the "messages in last 3 months" shows it. However when I go into the main dashboard, I see no sources, no souretypes & no hosts. If I create a new dashboard, with "all indexed data", I still don't see my data.

    I have moved the default index location by using
    $SPLUNK set datastore-dir /logdata/splunk_data $AUTH

    Sorry, I can't mail splunk.com, it gets blocked by my compaines spam filters, and you can't mail me.
    Posted by Rick1 on Sep 14 2008, 5:50pm

  5. This symtax seems to to fail
    ./splunk add index [name] [directory (optional)]

    eg
    [root@opbay03mclr default]# /opt/splunk/bin/splunk add index hello /tmp
    Command error: The argument '/tmp' is invalid. Arguments must be specified in the form '-argument value'.

    so we try again
    [root@opbay03mclr default]# /opt/splunk/bin/splunk add index hello directory /tmp
    Command error: The argument 'directory' is invalid. Arguments must be specified in the form '-argument value'.

    and some more
    [root@opbay03mclr default]# /opt/splunk/bin/splunk add index hello -directory /tmp
    An error occurred: The following parameters are invalid: directory.

    Please give an example, so its clear.
    Posted by Rick1 on Sep 14 2008, 5:35pm

Log in to comment.