Our blog

Decoding Splunk Indexes definition

indexes_in_Splunk

Decoding Splunk Indexes definition

Decoding Indexes.conf

Indexes.conf configuration file is used to manage and configure index settings. Use the [default] stanza to define any global settings and [<index>] stanza to define index level settings. If a setting is defined at both the global level and in a specific stanza, the value in the specific stanza takes precedence.

splunk

Below is the list of all available settings in indexes.conf categorized into settings type such as path, size, time, count, boolean and value.

Global Settings :

Path
 tsidxStatsHomePath
Size
 rtRouterQueueSize
 bucketRebuildMemoryHint
 memPoolMB
Time
 serviceInactiveIndexesPeriod
 serviceSubtaskTimingPeriod
 processTrackerServiceInterval
 hotBucketTimeRefreshInterval
Count
 indexThreads
 selfStorageThreads
 maxRunningProcessGroups
 maxRunningProcessGroupsLowPriority
 sync
Boolean
 rtRouterThreads
 assureUTF8
 enableRealtimeSearch
 inPlaceUpdates
Value
 defaultDatabase
 lastChanceIndex
 suppressBannerList

Per Index Settings:

Path
 bloomHomePath
 summaryHomePath
 tstatsHomePath
 remotePath

Size
 maxTotalDataSizeMB
 maxGlobalDataSizeMB
 rawChunkSizeBytes
 maxMemMB
 minStreamGroupQueueSize

Boolean
 disabled
 deleted
 isReadOnly
 createBloomfilter
 enableOnlineBucketRepair
 enableDataIntegrityControl
 syncMeta
 enableTsidxReduction
 suspendHotRollByDeleteQuery
 tsidxWritingLevel
Time
 maxBloomBackfillBucketAge
 hotlist_recency_secs
 hotlist_bloom_filter_recency_hours
 rotatePeriodInSecs
 minRawFileSyncSecs
 quarantinePastSecs
 quarantineFutureSecs
 serviceMetaPeriod
 partialServiceMetaPeriod
 throttleCheckPeriod
 maxTimeUnreplicatedWithAcks
 maxTimeUnreplicatedNoAcks
 streamingTargetTsidxSyncPeriodMsec
 tsidxReductionCheckPeriodInSec
 timePeriodInSecBeforeTsidxReduction

Count
 maxMetaEntries
 maxConcurrentOptimizes

Value
 splitByIndexKeys
 journalCompression

APPENDIX