Refine your search:

We have configured Splunk 4.2.2 running on Windows Server 2008 R2 with a coldPath pointing to a volume ("cold") hosted on a CIFS network drive.

Contents of indexes.conf : #Volume Definition

[volume:cold]
path = \\sjc-vault\SplunkArchive\splunk01
maxVolumeDataSizeMB = 1000000

################################################################################
# index definitions
################################################################################

[main]
coldPath = volume:cold\defaultdb\colddb
[history]
coldPath = volume:cold\historydb\colddb
[summary]
coldPath = volume:cold\summarydb\colddb
[_internal]
coldPath = volume:cold\_internaldb\colddb
[_audit]
coldPath = volume:cold\audit\colddb
[_thefishbucket]
coldPath = volume:cold\fishbucket\colddb
[_blocksignature]
coldPath = volume:cold\blockSignature\colddb

However, we get errors on startup for every index with a cold path set to the remote network drive:

In handler 'indexes': Unable to load index configuration: In index '_internal': Failed to create directory '\\sjc-vault\SplunkArchive\splunk02\_internaldb\colddb' (Cannot create a file when that file already exists.

We are using a domain account to run splunkd. This account has full rights to the shares and folders, therefore this should not be a permission issue.

Any advice is appreciated!

asked 13 Sep '11, 14:32

Splunker_J's gravatar image

Splunker_J ♦
1.1k5631
accept rate: 62%

edited 13 Sep '11, 17:04

Curious about the msg itself: Does '\sjc-vaultSplunkArchivesplunk02_internaldbcolddb' already exist? (if yes, can you delete that and start splunk up again)

(14 Sep '11, 04:31) LCM

One Answer:

CIFS is not a currently supported file system for Splunk indexing. Please check here for updates as new version of Splunk are made available: System Requirements:Supported File Systems

link

answered 15 Jun '12, 12:58

ekost's gravatar image

ekost ♦
55126
accept rate: 87%

Post your answer
toggle preview

Follow this question

Log In to enable email subscriptions

RSS:

Answers

Answers + Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "Title")
  • image?![alt text](/path/img.jpg "Title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Tags:

×479
×447
×28
×3

Asked: 13 Sep '11, 14:32

Seen: 617 times

Last updated: 15 Jun '12, 12:58

Copyright © 2005-2012 Splunk Inc. All rights reserved.