ADO.NET Provider for Splunk

Build 24.0.8963

CreateIndex

Create a data index.

Input

Name Type Required Description
Name String True The name of the index to create.
BlockSignSize String False Controls how many events make up a block for block signatures. If this is set to 0, block signing is disabled for this index. A recommended value is 100.
BucketRebuildMemoryHint String False Suggestion for the bucket rebuild process for the size of the time-series (tsidx) file to make. Default value, auto, varies by the amount of physical RAM on the host.
ColdPath String False An absolute path that contains the colddbs for the index. The path must be readable and writable.
ColdToFrozenDir String False Destination path for the frozen archive. Use as an alternative to a ColdToFrozenScript.
ColdToFrozenScript String False Path to the archiving script.
DataType String False Specifies the type of index.
EnableOnlineBucketRepair String False Enables asynchronous 'online fsck' bucket repair, which runs concurrently with splunk software. When enabled, you do not have to wait until buckets are repaired to start the splunk platform.
FrozenTimePeriodInSecs String False Number of seconds after which indexed data rolls to frozen. Defaults to 188697600 (6 years).
HomePath String False An absolute path that contains the hot and warm buckets for the index.
MaxBloomBackfillBucketAge String False Valid values are: integer[m|s|h|d] if a warm or cold bucket is older than the specified age, do not create or rebuild its bloomfilter. Specify 0 to never rebuild bloomfilters.
MaxConcurrentOptimizes String False The number of concurrent optimize processes that can run against a hot bucket.
MaxDataSize String False The maximum size in MB for a hot DB to reach before a roll to warm is triggered. Specifying 'auto' or 'auto_high_volume' causes Splunk software to autotune this parameter (recommended).
MaxHotBuckets String False Maximum hot buckets that can exist per index.
MaxHotIdleSecs String False Maximum life, in seconds, of a hot bucket.
MaxHotSpanSecs String False Upper bound of target maximum timespan of hot/warm buckets in seconds.
MaxMemMB String False The amount of memory, expressed in MB, to allocate for buffering a single tsidx file into memory before flushing to disk.
MaxMetaEntries String False Sets the maximum number of unique lines in . data files in a bucket, which may help to reduce memory consumption.
MaxTimeUnreplicatedNoAcks String False Upper limit, in seconds, on how long an event can sit in raw slice. Applies only if replication is enabled for this index.
MaxTimeUnreplicatedWithAcks String False Upper limit, in seconds, on how long events can sit unacknowledged in a raw slice. Applies only if you have enabled acks on forwarders and have replication enabled (with clustering).
MaxTotalDataSizeMB String False The maximum size of an index (in MB). If an index grows larger than the maximum size, the oldest data is frozen.
MaxWarmDBCount String False The maximum number of warm buckets. If this number is exceeded, the warm bucket/s with the lowest value for their latest times is moved to cold.
MinRawFileSyncSecs String False Specify an integer (or 'disable') for this parameter. This parameter sets how frequently splunkd forces a filesystem sync while compressing journal slices.
MinStreamGroupQueueSize String False Minimum size of the queue that stores events in memory before committing them to a tsidx file.
PartialServiceMetaPeriod String False Related to serviceMetaPeriod. If set, it enables metadata sync every SPECIFIED seconds, but only for records where the sync can be done efficiently in-place, without requiring a full re-write of the metadata file.
ProcessTrackerServiceInterval String False Specifies, in seconds, how often the indexer checks the status of the child OS processes it launched to see if it can launch new processes for queued requests. If set to 0, the indexer checks child process status every second.
QuarantineFutureSecs String False Events with timestamp of QuarantineFutureSecs newer than 'now' are dropped into quarantine bucket.
QuarantinePastSecs String False Events with timestamp of quarantinePastSecs older than 'now' are dropped into quarantine bucket.
RawChunkSizeBytes String False Target uncompressed size in bytes for individual raw slice in the rawdata journal of the index. 0 is not a valid value. If 0 is specified, rawChunkSizeBytes is set to the default value.
RepFactor String False Index replication control. This parameter applies to only clustering slaves. auto = Use the master index replication configuration value. 0 = Turn off replication for this index.
RotatePeriodInSecs String False How frequently (in seconds) to check if a new hot bucket needs to be created. Also, how frequently to check if there are any warm/cold buckets that should be rolled/frozen.
ServiceMetaPeriod String False Defines how frequently metadata is synced to disk, in seconds.
SyncMeta String False When true, a sync operation is called before file descriptor is closed on metadata file updates. This functionality improves integrity of metadata files, especially in regards to operating system crashes/machine failures.
ThawedPath String False An absolute path that contains the thawed (resurrected) databases for the index. Cannot be defined in terms of a volume definition.
ThrottleCheckPeriod String False Defines how frequently Splunk software checks for index throttling condition, in seconds.
TstatsHomePath String False Location to store datamodel acceleration TSIDX data for this index. If specified, it must be defined in terms of a volume definition. Path must be writable.
WarmToColdScript String False Path to a script to run when moving data from warm to cold.

Result Set Columns

Name Type Description
AssureUTF8 Boolean Boolean value indicating wheter all data retreived from the index is proper UTF8.
BlockSignSize Integer Controls how many events make up a block for block signatures. If this is set to 0, block signing is disabled for this index. A recommended value is 100.
BlockSignatureDatabase String The index that stores block signatures of events. This is a global setting, not a per index setting.
BucketRebuildMemoryHint String Suggestion for the bucket rebuild process for the size of the time-series (tsidx) file to make.
ColdPath String Filepath to the cold databases for the index.
ColdPathExpanded String Absoute filepath to the cold databases.
ColdToFrozenDir String Destination path for the frozen archive. Use as an alternative to a ColdToFrozenScript.
ColdToFrozenScript String Path to the archiving script.
CurrentDBSizeMB Integer Total size, in MB, of data stored in the index. The total incudes data in the home, cold and thawed paths.
DataType String The type of index.
DefaultDatabase String If no index destination information is available in the input data, the index shown here is the destination of such data.
EnableOnlineBucketRepair Boolean Enables asynchronous 'online fsck' bucket repair, which runs concurrently with splunk software. When enabled, you do not have to wait until buckets are repaired to start the splunk platform.
FrozenTimePeriodInSecs Integer Number of seconds after which indexed data rolls to frozen.
HomePath String An absolute path that contains the hot and warm buckets for the index.
HomePathExpanded String An absolute filepath to the hot and warm buckets for the index.
IndexThreads String Number of threads used for indexing. This is a global setting, not a per index setting.
IsInternal Boolean Indicates if this is an internal index.
IsReady Boolean Indicates if an index is properly initialized.
LastInitTime Datetime Last time the index processor was successfully initialized. This is a global setting, not a per index setting.
MaxBloomBackfillBucketAge String If a bucket (warm or cold) is older than this, Splunk software does not create (or re-create) its bloom filter.
MaxConcurrentOptimizes Integer The number of concurrent optimize processes that can run against a hot bucket.
MaxDataSize String The maximum size in MB for a hot DB to reach before a roll to warm is triggered. Specifying 'auto' or 'auto_high_volume' causes Splunk software to autotune this parameter (recommended).
MaxHotBuckets String Maximum hot buckets that can exist per index.
MaxHotIdleSecs Integer Maximum life, in seconds, of a hot bucket.
MaxHotSpanSecs Integer Upper bound of target maximum timespan of hot/warm buckets in seconds.
MaxMemMB Integer The amount of memory, expressed in MB, to allocate for buffering a single tsidx file into memory before flushing to disk.
MaxMetaEntries Integer Sets the maximum number of unique lines in . data files in a bucket, which may help to reduce memory consumption.
MaxTime Datetime ISO8601 timestamp ofThis setting is valid only when tsidxWritingLevel is at 4 or higher. This maximum term limit sets an upper bound on the number of terms kept inside an in-memory hash table that serves to improve tsidx compression.
MaxTimeUnreplicatedNoAcks Integer Upper limit, in seconds, on how long an event can sit in raw slice. Applies only if replication is enabled for this index.
MaxTimeUnreplicatedWithAcks Integer Upper limit, in seconds, on how long events can sit unacknowledged in a raw slice. Applies only if you have enabled acks on forwarders and have replication enabled (with clustering).
MaxTotalDataSizeMB Integer The maximum size of an index (in MB). If an index grows larger than the maximum size, the oldest data is frozen.
MaxWarmDBCount String The maximum number of warm buckets. If this number is exceeded, the warm bucket/s with the lowest value for their latest times is moved to cold.
MemPoolMB String Determines how much memory is given to the indexer memory pool. This is a global setting, not a per-index setting.
MinRawFileSyncSecs String Specify an integer (or 'disable') for this parameter. This parameter sets how frequently splunkd forces a filesystem sync while compressing journal slices.
MinStreamGroupQueueSize Integer Minimum size of the queue that stores events in memory before committing them to a tsidx file.
MinTime Datetime ISO8601 timestamp of the oldest event time in the index.
PartialServiceMetaPeriod Integer Related to serviceMetaPeriod. If set, it enables metadata sync every SPECIFIED seconds, but only for records where the sync can be done efficiently in-place, without requiring a full re-write of the metadata file.
ProcessTrackerServiceInterval Integer Specifies, in seconds, how often the indexer checks the status of the child OS processes it launched to see if it can launch new processes for queued requests. If set to 0, the indexer checks child process status every second.
QuarantineFutureSecs Integer Events with timestamp of QuarantineFutureSecs newer than 'now' are dropped into quarantine bucket.
QuarantinePastSecs Integer Events with timestamp of quarantinePastSecs older than 'now' are dropped into quarantine bucket.
RawChunkSizeBytes Integer Target uncompressed size in bytes for individual raw slice in the rawdata journal of the index. 0 is not a valid value. If 0 is specified, rawChunkSizeBytes is set to the default value.
RepFactor String Index replication control. This parameter applies to only clustering slaves. auto = Use the master index replication configuration value. 0 = Turn off replication for this index.
RotatePeriodInSecs Integer How frequently (in seconds) to check if a new hot bucket needs to be created. Also, how frequently to check if there are any warm/cold buckets that should be rolled/frozen.
ServiceMetaPeriod Integer Defines how frequently metadata is synced to disk, in seconds.
SuppressBannerList String List of indexes for which we suppress 'index missing' warning banner messages. This is a global setting, not a per index setting.
Sync String Specifies the number of events that trigger the indexer to sync events. This is a global setting, not a per index setting.
SyncMeta Boolean When true, a sync operation is called before file descriptor is closed on metadata file updates. This functionality improves integrity of metadata files, especially in regards to operating system crashes/machine failures.
ThawedPath String An absolute path that contains the thawed (resurrected) databases for the index. Cannot be defined in terms of a volume definition.
ThawedPathExpanded String Absolute filepath to the thawed (resurrected) databases.
ThrottleCheckPeriod Integer Defines how frequently Splunk software checks for index throttling condition, in seconds.
TotalEventCount Integer Total number of events in the index.
TsidxDedupPostingsListMaxTermsLimit Integer This setting is valid only when tsidxWritingLevel is at 4 or higher. This maximum term limit sets an upper bound on the number of terms kept inside an in-memory hash table that serves to improve tsidx compression.
TstatsHomePath String Location to store datamodel acceleration TSIDX data for this index. If specified, it must be defined in terms of a volume definition. Path must be writable.
WarmToColdScript String Path to a script to run when moving data from warm to cold.
Success Boolean Boolean indicating whether the stored procedure was executed successfully.
ErrorCode Integer The error code in case the procedure is not executed successfully.
ErrorMessage String The error message in case the procedure is not executed successfully.

Copyright (c) 2024 CData Software, Inc. - All rights reserved.
Build 24.0.8963