Decoding Splunk Indexes

Decoding Indexes.conf

Indexes.conf configuration file is used to manage and configure splunk index settings. Use the [default] stanza to define any global settings and [<index>] stanza to define index level settings. If a setting is defined at both the global level and in a specific stanza, the value in the specific stanza takes precedence.

Below is the list of all available settings in indexes.conf categorized into settings type such as path, size, time, count, boolean and value.

Global Settings :

Path  tsidxStatsHomePath

Size  rtRouterQueueSize  bucketRebuildMemoryHint  memPoolMB

Time  serviceInactiveIndexesPeriod  serviceSubtaskTimingPeriod  processTrackerServiceInterval  hotBucketTimeRefreshInterval

Count  indexThreads  selfStorageThreads  maxRunningProcessGroups  maxRunningProcessGroupsLowPriority  sync

Boolean  rtRouterThreads  assureUTF8  enableRealtimeSearch  inPlaceUpdates

Value  defaultDatabase  lastChanceIndex  suppressBannerList

Per Index Settings:

Path  bloomHomePath  summaryHomePath  tstatsHomePath  remotePath Size  maxTotalDataSizeMB  maxGlobalDataSizeMB  rawChunkSizeBytes  maxMemMB  minStreamGroupQueueSize Boolean  disabled  deleted  isReadOnly  createBloomfilter  enableOnlineBucketRepair  enableDataIntegrityControl  syncMeta  enableTsidxReduction  suspendHotRollByDeleteQuery  tsidxWritingLevel

Time  maxBloomBackfillBucketAge  hotlist_recency_secs  hotlist_bloom_filter_recency_hours  rotatePeriodInSecs  minRawFileSyncSecs  quarantinePastSecs  quarantineFutureSecs  serviceMetaPeriod  partialServiceMetaPeriod  throttleCheckPeriod  maxTimeUnreplicatedWithAcks  maxTimeUnreplicatedNoAcks  streamingTargetTsidxSyncPeriodMsec  tsidxReductionCheckPeriodInSec  timePeriodInSecBeforeTsidxReduction Count  maxMetaEntries  maxConcurrentOptimizes Value  splitByIndexKeys  journalCompression

APPENDIX