Our blog

Decoding Splunk Indexes

Splunk Index

Decoding Indexes.conf

Indexes.conf configuration file is used to manage and configure splunk index settings. Use the [default] stanza to define any global settings and [<index>] stanza to define index level settings. If a setting is defined at both the global level and in a specific stanza, the value in the specific stanza takes precedence.

Splunk Index Example Flowchart

Below is the list of all available settings in indexes.conf categorized into settings type such as path, size, time, count, boolean and value.

Global Settings :

Path
 tsidxStatsHomePath
Size
 rtRouterQueueSize
 bucketRebuildMemoryHint
 memPoolMB
Time
 serviceInactiveIndexesPeriod
 serviceSubtaskTimingPeriod
 processTrackerServiceInterval
 hotBucketTimeRefreshInterval
Count
 indexThreads
 selfStorageThreads
 maxRunningProcessGroups
 maxRunningProcessGroupsLowPriority
 sync
Boolean
 rtRouterThreads
 assureUTF8
 enableRealtimeSearch
 inPlaceUpdates
Value
 defaultDatabase
 lastChanceIndex
 suppressBannerList

Per Index Settings:

Path
 bloomHomePath
 summaryHomePath
 tstatsHomePath
 remotePath

Size
 maxTotalDataSizeMB
 maxGlobalDataSizeMB
 rawChunkSizeBytes
 maxMemMB
 minStreamGroupQueueSize

Boolean
 disabled
 deleted
 isReadOnly
 createBloomfilter
 enableOnlineBucketRepair
 enableDataIntegrityControl
 syncMeta
 enableTsidxReduction
 suspendHotRollByDeleteQuery
 tsidxWritingLevel
Time
 maxBloomBackfillBucketAge
 hotlist_recency_secs
 hotlist_bloom_filter_recency_hours
 rotatePeriodInSecs
 minRawFileSyncSecs
 quarantinePastSecs
 quarantineFutureSecs
 serviceMetaPeriod
 partialServiceMetaPeriod
 throttleCheckPeriod
 maxTimeUnreplicatedWithAcks
 maxTimeUnreplicatedNoAcks
 streamingTargetTsidxSyncPeriodMsec
 tsidxReductionCheckPeriodInSec
 timePeriodInSecBeforeTsidxReduction

Count
 maxMetaEntries
 maxConcurrentOptimizes

Value
 splitByIndexKeys
 journalCompression

APPENDIX