You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
264 lines
9.5 KiB
264 lines
9.5 KiB
#Version 9.2.2.20240415
|
|
#DO NOT EDIT THIS FILE!
|
|
# Changes to default files will be lost on update and are difficult to
|
|
# manage and support.
|
|
#
|
|
# Please make any changes to system defaults by overriding them in
|
|
# apps or $SPLUNK_HOME/etc/system/local
|
|
# (See "Configuration file precedence" in the web documentation).
|
|
#
|
|
# To override a specific setting, copy the name of the stanza and
|
|
# setting to the file where you wish to override it.
|
|
#
|
|
# This file configures Splunk's indexes and their properties.
|
|
#
|
|
|
|
################################################################################
|
|
# "global" params (not specific to individual indexes)
|
|
################################################################################
|
|
sync = 0
|
|
indexThreads = auto
|
|
memPoolMB = auto
|
|
defaultDatabase = main
|
|
enableRealtimeSearch = true
|
|
suppressBannerList =
|
|
maxRunningProcessGroups = 8
|
|
maxRunningProcessGroupsLowPriority = 1
|
|
bucketRebuildMemoryHint = auto
|
|
serviceOnlyAsNeeded = true
|
|
serviceSubtaskTimingPeriod = 30
|
|
serviceInactiveIndexesPeriod = 60
|
|
maxBucketSizeCacheEntries = 0
|
|
processTrackerServiceInterval = 1
|
|
hotBucketTimeRefreshInterval = 10
|
|
rtRouterThreads = 0
|
|
rtRouterQueueSize = 10000
|
|
selfStorageThreads = 2
|
|
fileSystemExecutorWorkers = 5
|
|
hotBucketStreaming.extraBucketBuildingCmdlineArgs =
|
|
|
|
################################################################################
|
|
# index specific defaults
|
|
################################################################################
|
|
maxDataSize = auto
|
|
maxWarmDBCount = 300
|
|
frozenTimePeriodInSecs = 188697600
|
|
rotatePeriodInSecs = 60
|
|
coldToFrozenScript =
|
|
coldToFrozenDir =
|
|
compressRawdata = true
|
|
maxTotalDataSizeMB = 500000
|
|
maxGlobalRawDataSizeMB = 0
|
|
maxGlobalDataSizeMB = 0
|
|
maxMemMB = 5
|
|
maxConcurrentOptimizes = 6
|
|
maxHotSpanSecs = 7776000
|
|
maxHotIdleSecs = 0
|
|
maxHotBuckets = auto
|
|
metric.maxHotBuckets = auto
|
|
minHotIdleSecsBeforeForceRoll = auto
|
|
quarantinePastSecs = 77760000
|
|
quarantineFutureSecs = 2592000
|
|
rawChunkSizeBytes = 131072
|
|
minRawFileSyncSecs = disable
|
|
assureUTF8 = false
|
|
serviceMetaPeriod = 25
|
|
partialServiceMetaPeriod = 0
|
|
throttleCheckPeriod = 15
|
|
syncMeta = true
|
|
maxMetaEntries = 1000000
|
|
maxBloomBackfillBucketAge = 30d
|
|
enableOnlineBucketRepair = true
|
|
enableDataIntegrityControl = false
|
|
maxTimeUnreplicatedWithAcks = 60
|
|
maxTimeUnreplicatedNoAcks = 300
|
|
minStreamGroupQueueSize = 2000
|
|
warmToColdScript=
|
|
tstatsHomePath = volume:_splunk_summaries/$_index_name/datamodel_summary
|
|
homePath.maxDataSizeMB = 0
|
|
coldPath.maxDataSizeMB = 0
|
|
streamingTargetTsidxSyncPeriodMsec = 5000
|
|
journalCompression = zstd
|
|
enableTsidxReduction = false
|
|
suspendHotRollByDeleteQuery = false
|
|
tsidxReductionCheckPeriodInSec = 600
|
|
timePeriodInSecBeforeTsidxReduction = 604800
|
|
datatype = event
|
|
splitByIndexKeys =
|
|
metric.splitByIndexKeys =
|
|
tsidxWritingLevel = 3
|
|
hotBucketStreaming.sendSlices = false
|
|
hotBucketStreaming.removeRemoteSlicesOnRoll = false
|
|
hotBucketStreaming.reportStatus = false
|
|
hotBucketStreaming.deleteHotsAfterRestart = false
|
|
tsidxDedupPostingsListMaxTermsLimit = 8388608
|
|
tsidxTargetSizeMB = 1500
|
|
metric.tsidxTargetSizeMB = 1500
|
|
metric.enableFloatingPointCompression = true
|
|
metric.compressionBlockSize = 1024
|
|
metric.stubOutRawdataJournal = true
|
|
metric.timestampResolution = s
|
|
waitPeriodInSecsForManifestWrite = 60
|
|
bucketMerging = false
|
|
bucketMerge.minMergeSizeMB = 750
|
|
bucketMerge.maxMergeSizeMB = 1000
|
|
bucketMerge.maxMergeTimeSpanSecs = 7776000
|
|
|
|
#
|
|
# By default none of the indexes are replicated.
|
|
#
|
|
repFactor = 0
|
|
|
|
# Splunk to Splunk federated index
|
|
federated.provider =
|
|
federated.dataset =
|
|
|
|
[volume:_splunk_summaries]
|
|
path = $SPLUNK_DB
|
|
|
|
[provider-family:hadoop]
|
|
vix.mode = report
|
|
vix.command = $SPLUNK_HOME/bin/jars/sudobash
|
|
vix.command.arg.1 = $HADOOP_HOME/bin/hadoop
|
|
vix.command.arg.2 = jar
|
|
vix.command.arg.3 = $SPLUNK_HOME/bin/jars/SplunkMR-h1.jar
|
|
vix.command.arg.4 = com.splunk.mr.SplunkMR
|
|
vix.env.MAPREDUCE_USER =
|
|
vix.env.HADOOP_HEAPSIZE = 512
|
|
vix.env.HADOOP_CLIENT_OPTS = -XX:ParallelGCThreads=4 -XX:+UseParallelGC -XX:+DisplayVMOutputToStderr
|
|
vix.env.HUNK_THIRDPARTY_JARS = $SPLUNK_HOME/bin/jars/thirdparty/common/avro-1.9.1.jar,$SPLUNK_HOME/bin/jars/thirdparty/common/avro-mapred-1.9.1.jar,$SPLUNK_HOME/bin/jars/thirdparty/common/commons-compress-1.21.jar,$SPLUNK_HOME/bin/jars/thirdparty/common/commons-io-2.4.jar,$SPLUNK_HOME/bin/jars/thirdparty/common/libfb303-0.9.2.jar,$SPLUNK_HOME/bin/jars/thirdparty/common/parquet-hive-bundle-1.10.1.jar,$SPLUNK_HOME/bin/jars/thirdparty/common/snappy-java-1.1.1.7.jar,$SPLUNK_HOME/bin/jars/thirdparty/hive/hive-exec-0.12.0.jar,$SPLUNK_HOME/bin/jars/thirdparty/hive/hive-metastore-0.12.0.jar,$SPLUNK_HOME/bin/jars/thirdparty/hive/hive-serde-0.12.0.jar
|
|
vix.mapred.job.reuse.jvm.num.tasks = 100
|
|
vix.mapred.child.java.opts = -server -Xmx512m -XX:ParallelGCThreads=4 -XX:+UseParallelGC -XX:+DisplayVMOutputToStderr
|
|
vix.mapred.reduce.tasks = 0
|
|
vix.mapred.job.map.memory.mb = 2048
|
|
vix.mapred.job.reduce.memory.mb = 512
|
|
vix.mapred.job.queue.name = default
|
|
vix.mapreduce.job.jvm.numtasks = 100
|
|
vix.mapreduce.map.java.opts = -server -Xmx512m -XX:ParallelGCThreads=4 -XX:+UseParallelGC -XX:+DisplayVMOutputToStderr
|
|
vix.mapreduce.reduce.java.opts = -server -Xmx512m -XX:ParallelGCThreads=4 -XX:+UseParallelGC -XX:+DisplayVMOutputToStderr
|
|
vix.mapreduce.job.reduces = 0
|
|
vix.mapreduce.map.memory.mb = 2048
|
|
vix.mapreduce.reduce.memory.mb = 512
|
|
vix.mapreduce.job.queuename = default
|
|
vix.splunk.search.column.filter = 1
|
|
vix.splunk.search.mixedmode = 1
|
|
vix.splunk.search.debug = 0
|
|
vix.splunk.search.mr.maxsplits = 10000
|
|
vix.splunk.search.mr.minsplits = 100
|
|
vix.splunk.search.mr.splits.multiplier = 10
|
|
vix.splunk.search.mr.poll = 2000
|
|
vix.splunk.search.recordreader = SplunkJournalRecordReader,ValueAvroRecordReader,SimpleCSVRecordReader,SequenceFileRecordReader
|
|
vix.splunk.search.recordreader.avro.regex = \.avro$
|
|
vix.splunk.search.recordreader.csv.regex = \.([tc]sv)(?:\.(?:gz|bz2|snappy))?$
|
|
vix.splunk.search.recordreader.sequence.regex = \.seq$
|
|
vix.splunk.home.datanode = /tmp/splunk/$SPLUNK_SERVER_NAME/
|
|
vix.splunk.heartbeat = 1
|
|
vix.splunk.heartbeat.threshold = 60
|
|
vix.splunk.heartbeat.interval = 1000
|
|
vix.splunk.setup.onsearch = 1
|
|
vix.splunk.setup.package = current
|
|
|
|
################################################################################
|
|
# index definitions
|
|
################################################################################
|
|
|
|
[main]
|
|
homePath = $SPLUNK_DB/defaultdb/db
|
|
coldPath = $SPLUNK_DB/defaultdb/colddb
|
|
thawedPath = $SPLUNK_DB/defaultdb/thaweddb
|
|
tstatsHomePath = volume:_splunk_summaries/defaultdb/datamodel_summary
|
|
maxMemMB = 20
|
|
maxConcurrentOptimizes = 6
|
|
maxHotIdleSecs = 86400
|
|
maxHotBuckets = 10
|
|
maxDataSize = auto_high_volume
|
|
|
|
[history]
|
|
homePath = $SPLUNK_DB/historydb/db
|
|
coldPath = $SPLUNK_DB/historydb/colddb
|
|
thawedPath = $SPLUNK_DB/historydb/thaweddb
|
|
tstatsHomePath = volume:_splunk_summaries/historydb/datamodel_summary
|
|
maxDataSize = 10
|
|
frozenTimePeriodInSecs = 604800
|
|
|
|
[summary]
|
|
homePath = $SPLUNK_DB/summarydb/db
|
|
coldPath = $SPLUNK_DB/summarydb/colddb
|
|
thawedPath = $SPLUNK_DB/summarydb/thaweddb
|
|
tstatsHomePath = volume:_splunk_summaries/summarydb/datamodel_summary
|
|
|
|
[_internal]
|
|
homePath = $SPLUNK_DB/_internaldb/db
|
|
coldPath = $SPLUNK_DB/_internaldb/colddb
|
|
thawedPath = $SPLUNK_DB/_internaldb/thaweddb
|
|
tstatsHomePath = volume:_splunk_summaries/_internaldb/datamodel_summary
|
|
maxDataSize = 1000
|
|
maxHotSpanSecs = 432000
|
|
frozenTimePeriodInSecs = 2592000
|
|
|
|
[_audit]
|
|
homePath = $SPLUNK_DB/audit/db
|
|
coldPath = $SPLUNK_DB/audit/colddb
|
|
thawedPath = $SPLUNK_DB/audit/thaweddb
|
|
tstatsHomePath = volume:_splunk_summaries/audit/datamodel_summary
|
|
|
|
[_thefishbucket]
|
|
homePath = $SPLUNK_DB/fishbucket/db
|
|
coldPath = $SPLUNK_DB/fishbucket/colddb
|
|
thawedPath = $SPLUNK_DB/fishbucket/thaweddb
|
|
tstatsHomePath = volume:_splunk_summaries/fishbucket/datamodel_summary
|
|
maxDataSize = 500
|
|
frozenTimePeriodInSecs = 2419200
|
|
|
|
# this index has been removed in the 4.1 series, but this stanza must be
|
|
# preserved to avoid displaying errors for users that have tweaked the index's
|
|
# size/etc parameters in local/indexes.conf.
|
|
#
|
|
[splunklogger]
|
|
homePath = $SPLUNK_DB/splunklogger/db
|
|
coldPath = $SPLUNK_DB/splunklogger/colddb
|
|
thawedPath = $SPLUNK_DB/splunklogger/thaweddb
|
|
disabled = true
|
|
|
|
[_introspection]
|
|
homePath = $SPLUNK_DB/_introspection/db
|
|
coldPath = $SPLUNK_DB/_introspection/colddb
|
|
thawedPath = $SPLUNK_DB/_introspection/thaweddb
|
|
maxDataSize = 1024
|
|
frozenTimePeriodInSecs = 1209600
|
|
|
|
[_telemetry]
|
|
homePath = $SPLUNK_DB/_telemetry/db
|
|
coldPath = $SPLUNK_DB/_telemetry/colddb
|
|
thawedPath = $SPLUNK_DB/_telemetry/thaweddb
|
|
maxDataSize = 256
|
|
frozenTimePeriodInSecs = 63072000
|
|
|
|
[_metrics]
|
|
homePath = $SPLUNK_DB/_metrics/db
|
|
coldPath = $SPLUNK_DB/_metrics/colddb
|
|
thawedPath = $SPLUNK_DB/_metrics/thaweddb
|
|
datatype = metric
|
|
#14 day retention
|
|
frozenTimePeriodInSecs = 1209600
|
|
metric.splitByIndexKeys = metric_name
|
|
|
|
# Internal Use Only: rollup data from the _metrics index.
|
|
[_metrics_rollup]
|
|
homePath = $SPLUNK_DB/_metrics_rollup/db
|
|
coldPath = $SPLUNK_DB/_metrics_rollup/colddb
|
|
thawedPath = $SPLUNK_DB/_metrics_rollup/thaweddb
|
|
datatype = metric
|
|
# 2 year retention
|
|
frozenTimePeriodInSecs = 63072000
|
|
metric.splitByIndexKeys = metric_name
|
|
|
|
[_configtracker]
|
|
homePath = $SPLUNK_DB/_configtracker/db
|
|
coldPath = $SPLUNK_DB/_configtracker/colddb
|
|
thawedPath = $SPLUNK_DB/_configtracker/thaweddb
|
|
frozenTimePeriodInSecs = 2592000
|
|
|
|
# NOTE: When adding a new index, please also add an entry in cfg/bundles/cluster/default/indexes.conf.in
|
|
# with repFactor=0, homePath, coldPath, and thawedPath
|