CreateIndex
Create a data index.
Input
| Name | Type | Required | Description |
| Name | String | True | The name of the index to create. |
| BlockSignSize | String | False | Controls how many events make up a block for block signatures. If this is set to 0, block signing is disabled for this index. A recommended value is 100. |
| BucketRebuildMemoryHint | String | False | Suggestion for the bucket rebuild process for the size of the time-series (tsidx) file to make. Default value, auto, varies by the amount of physical RAM on the host. |
| ColdPath | String | False | An absolute path that contains the colddbs for the index. The path must be readable and writable. |
| ColdToFrozenDir | String | False | Destination path for the frozen archive. Use as an alternative to a ColdToFrozenScript. |
| ColdToFrozenScript | String | False | Path to the archiving script. |
| DataType | String | False | Specifies the type of index. |
| EnableOnlineBucketRepair | String | False | Enables asynchronous 'online fsck' bucket repair, which runs concurrently with splunk software. When enabled, you do not have to wait until buckets are repaired to start the splunk platform. |
| FrozenTimePeriodInSecs | String | False | Number of seconds after which indexed data rolls to frozen. Defaults to 188697600 (6 years). |
| HomePath | String | False | An absolute path that contains the hot and warm buckets for the index. |
| MaxBloomBackfillBucketAge | String | False | Valid values are: integer[m|s|h|d] if a warm or cold bucket is older than the specified age, do not create or rebuild its bloomfilter. Specify 0 to never rebuild bloomfilters. |
| MaxConcurrentOptimizes | String | False | The number of concurrent optimize processes that can run against a hot bucket. |
| MaxDataSize | String | False | The maximum size in MB for a hot DB to reach before a roll to warm is triggered. Specifying 'auto' or 'auto_high_volume' causes Splunk software to autotune this parameter (recommended). |
| MaxHotBuckets | String | False | Maximum hot buckets that can exist per index. |
| MaxHotIdleSecs | String | False | Maximum life, in seconds, of a hot bucket. |
| MaxHotSpanSecs | String | False | Upper bound of target maximum timespan of hot/warm buckets in seconds. |
| MaxMemMB | String | False | The amount of memory, expressed in MB, to allocate for buffering a single tsidx file into memory before flushing to disk. |
| MaxMetaEntries | String | False | Sets the maximum number of unique lines in . data files in a bucket, which may help to reduce memory consumption. |
| MaxTimeUnreplicatedNoAcks | String | False | Upper limit, in seconds, on how long an event can sit in raw slice. Applies only if replication is enabled for this index. |
| MaxTimeUnreplicatedWithAcks | String | False | Upper limit, in seconds, on how long events can sit unacknowledged in a raw slice. Applies only if you have enabled acks on forwarders and have replication enabled (with clustering). |
| MaxTotalDataSizeMB | String | False | The maximum size of an index (in MB). If an index grows larger than the maximum size, the oldest data is frozen. |
| MaxWarmDBCount | String | False | The maximum number of warm buckets. If this number is exceeded, the warm bucket/s with the lowest value for their latest times is moved to cold. |
| MinRawFileSyncSecs | String | False | Specify an integer (or 'disable') for this parameter. This parameter sets how frequently splunkd forces a filesystem sync while compressing journal slices. |
| MinStreamGroupQueueSize | String | False | Minimum size of the queue that stores events in memory before committing them to a tsidx file. |
| PartialServiceMetaPeriod | String | False | Related to serviceMetaPeriod. If set, it enables metadata sync every SPECIFIED seconds, but only for records where the sync can be done efficiently in-place, without requiring a full re-write of the metadata file. |
| ProcessTrackerServiceInterval | String | False | Specifies, in seconds, how often the indexer checks the status of the child OS processes it launched to see if it can launch new processes for queued requests. If set to 0, the indexer checks child process status every second. |
| QuarantineFutureSecs | String | False | Events with timestamp of QuarantineFutureSecs newer than 'now' are dropped into quarantine bucket. |
| QuarantinePastSecs | String | False | Events with timestamp of quarantinePastSecs older than 'now' are dropped into quarantine bucket. |
| RawChunkSizeBytes | String | False | Target uncompressed size in bytes for individual raw slice in the rawdata journal of the index. 0 is not a valid value. If 0 is specified, rawChunkSizeBytes is set to the default value. |
| RepFactor | String | False | Index replication control. This parameter applies to only clustering slaves. auto = Use the master index replication configuration value. 0 = Turn off replication for this index. |
| RotatePeriodInSecs | String | False | How frequently (in seconds) to check if a new hot bucket needs to be created. Also, how frequently to check if there are any warm/cold buckets that should be rolled/frozen. |
| ServiceMetaPeriod | String | False | Defines how frequently metadata is synced to disk, in seconds. |
| SyncMeta | String | False | When true, a sync operation is called before file descriptor is closed on metadata file updates. This functionality improves integrity of metadata files, especially in regards to operating system crashes/machine failures. |
| ThawedPath | String | False | An absolute path that contains the thawed (resurrected) databases for the index. Cannot be defined in terms of a volume definition. |
| ThrottleCheckPeriod | String | False | Defines how frequently Splunk software checks for index throttling condition, in seconds. |
| TstatsHomePath | String | False | Location to store datamodel acceleration TSIDX data for this index. If specified, it must be defined in terms of a volume definition. Path must be writable. |
| WarmToColdScript | String | False | Path to a script to run when moving data from warm to cold. |
Result Set Columns
| Name | Type | Description |
| AssureUTF8 | Boolean | Boolean value indicating wheter all data retreived from the index is proper UTF8. |
| BlockSignSize | Integer | Controls how many events make up a block for block signatures. If this is set to 0, block signing is disabled for this index. A recommended value is 100. |
| BlockSignatureDatabase | String | The index that stores block signatures of events. This is a global setting, not a per index setting. |
| BucketRebuildMemoryHint | String | Suggestion for the bucket rebuild process for the size of the time-series (tsidx) file to make. |
| ColdPath | String | Filepath to the cold databases for the index. |
| ColdPathExpanded | String | Absoute filepath to the cold databases. |
| ColdToFrozenDir | String | Destination path for the frozen archive. Use as an alternative to a ColdToFrozenScript. |
| ColdToFrozenScript | String | Path to the archiving script. |
| CurrentDBSizeMB | Integer | Total size, in MB, of data stored in the index. The total incudes data in the home, cold and thawed paths. |
| DataType | String | The type of index. |
| DefaultDatabase | String | If no index destination information is available in the input data, the index shown here is the destination of such data. |
| EnableOnlineBucketRepair | Boolean | Enables asynchronous 'online fsck' bucket repair, which runs concurrently with splunk software. When enabled, you do not have to wait until buckets are repaired to start the splunk platform. |
| FrozenTimePeriodInSecs | Integer | Number of seconds after which indexed data rolls to frozen. |
| HomePath | String | An absolute path that contains the hot and warm buckets for the index. |
| HomePathExpanded | String | An absolute filepath to the hot and warm buckets for the index. |
| IndexThreads | String | Number of threads used for indexing. This is a global setting, not a per index setting. |
| IsInternal | Boolean | Indicates if this is an internal index. |
| IsReady | Boolean | Indicates if an index is properly initialized. |
| LastInitTime | Datetime | Last time the index processor was successfully initialized. This is a global setting, not a per index setting. |
| MaxBloomBackfillBucketAge | String | If a bucket (warm or cold) is older than this, Splunk software does not create (or re-create) its bloom filter. |
| MaxConcurrentOptimizes | Integer | The number of concurrent optimize processes that can run against a hot bucket. |
| MaxDataSize | String | The maximum size in MB for a hot DB to reach before a roll to warm is triggered. Specifying 'auto' or 'auto_high_volume' causes Splunk software to autotune this parameter (recommended). |
| MaxHotBuckets | String | Maximum hot buckets that can exist per index. |
| MaxHotIdleSecs | Integer | Maximum life, in seconds, of a hot bucket. |
| MaxHotSpanSecs | Integer | Upper bound of target maximum timespan of hot/warm buckets in seconds. |
| MaxMemMB | Integer | The amount of memory, expressed in MB, to allocate for buffering a single tsidx file into memory before flushing to disk. |
| MaxMetaEntries | Integer | Sets the maximum number of unique lines in . data files in a bucket, which may help to reduce memory consumption. |
| MaxTime | Datetime | ISO8601 timestamp ofThis setting is valid only when tsidxWritingLevel is at 4 or higher. This maximum term limit sets an upper bound on the number of terms kept inside an in-memory hash table that serves to improve tsidx compression. |
| MaxTimeUnreplicatedNoAcks | Integer | Upper limit, in seconds, on how long an event can sit in raw slice. Applies only if replication is enabled for this index. |
| MaxTimeUnreplicatedWithAcks | Integer | Upper limit, in seconds, on how long events can sit unacknowledged in a raw slice. Applies only if you have enabled acks on forwarders and have replication enabled (with clustering). |
| MaxTotalDataSizeMB | Integer | The maximum size of an index (in MB). If an index grows larger than the maximum size, the oldest data is frozen. |
| MaxWarmDBCount | String | The maximum number of warm buckets. If this number is exceeded, the warm bucket/s with the lowest value for their latest times is moved to cold. |
| MemPoolMB | String | Determines how much memory is given to the indexer memory pool. This is a global setting, not a per-index setting. |
| MinRawFileSyncSecs | String | Specify an integer (or 'disable') for this parameter. This parameter sets how frequently splunkd forces a filesystem sync while compressing journal slices. |
| MinStreamGroupQueueSize | Integer | Minimum size of the queue that stores events in memory before committing them to a tsidx file. |
| MinTime | Datetime | ISO8601 timestamp of the oldest event time in the index. |
| PartialServiceMetaPeriod | Integer | Related to serviceMetaPeriod. If set, it enables metadata sync every SPECIFIED seconds, but only for records where the sync can be done efficiently in-place, without requiring a full re-write of the metadata file. |
| ProcessTrackerServiceInterval | Integer | Specifies, in seconds, how often the indexer checks the status of the child OS processes it launched to see if it can launch new processes for queued requests. If set to 0, the indexer checks child process status every second. |
| QuarantineFutureSecs | Integer | Events with timestamp of QuarantineFutureSecs newer than 'now' are dropped into quarantine bucket. |
| QuarantinePastSecs | Integer | Events with timestamp of quarantinePastSecs older than 'now' are dropped into quarantine bucket. |
| RawChunkSizeBytes | Integer | Target uncompressed size in bytes for individual raw slice in the rawdata journal of the index. 0 is not a valid value. If 0 is specified, rawChunkSizeBytes is set to the default value. |
| RepFactor | String | Index replication control. This parameter applies to only clustering slaves. auto = Use the master index replication configuration value. 0 = Turn off replication for this index. |
| RotatePeriodInSecs | Integer | How frequently (in seconds) to check if a new hot bucket needs to be created. Also, how frequently to check if there are any warm/cold buckets that should be rolled/frozen. |
| ServiceMetaPeriod | Integer | Defines how frequently metadata is synced to disk, in seconds. |
| SuppressBannerList | String | List of indexes for which we suppress 'index missing' warning banner messages. This is a global setting, not a per index setting. |
| Sync | String | Specifies the number of events that trigger the indexer to sync events. This is a global setting, not a per index setting. |
| SyncMeta | Boolean | When true, a sync operation is called before file descriptor is closed on metadata file updates. This functionality improves integrity of metadata files, especially in regards to operating system crashes/machine failures. |
| ThawedPath | String | An absolute path that contains the thawed (resurrected) databases for the index. Cannot be defined in terms of a volume definition. |
| ThawedPathExpanded | String | Absolute filepath to the thawed (resurrected) databases. |
| ThrottleCheckPeriod | Integer | Defines how frequently Splunk software checks for index throttling condition, in seconds. |
| TotalEventCount | Integer | Total number of events in the index. |
| TsidxDedupPostingsListMaxTermsLimit | Integer | This setting is valid only when tsidxWritingLevel is at 4 or higher. This maximum term limit sets an upper bound on the number of terms kept inside an in-memory hash table that serves to improve tsidx compression. |
| TstatsHomePath | String | Location to store datamodel acceleration TSIDX data for this index. If specified, it must be defined in terms of a volume definition. Path must be writable. |
| WarmToColdScript | String | Path to a script to run when moving data from warm to cold. |
| Success | Boolean | Boolean indicating whether the stored procedure was executed successfully. |
| ErrorCode | Integer | The error code in case the procedure is not executed successfully. |
| ErrorMessage | String | The error message in case the procedure is not executed successfully. |