https://community.splunk.com/t5/Deployment-Architecture/Splunk-is-using-the-wrong-disk-for-some-reason-why/m-p/203154#M23679 <P><CODE>$SPLUNK_HOME/var/run/searchpeers</CODE> stores bundles from your search heads used by the indexer to run searches for them with the appropriate configurations. Indexing happens elsewhere, by default in <CODE>$SPLUNK_HOME/var/lib/splunk</CODE> - see if that's fairly small compared to what you've defined on your second drive to confirm that the index path setting is working.</P> <P>As for your searchpeers folder using 13GB, this can have several reasons:<BR /> - is your bundle huge, e.g. massive lookup files?<BR /> - do you have many search heads, each distributing different bundles? Consider merging the search heads into a search head cluster, reducing the number of different bundles on your indexers.<BR /> - are there old bundles from legacy search heads? These can be deleted.</P> Sat, 13 Feb 2016 13:24:10 GMT martin_mueller 2016-02-13T13:24:10Z https://community.splunk.com/t5/Deployment-Architecture/Splunk-is-using-the-wrong-disk-for-some-reason-why/m-p/203153#M23678 <P>I have 2 drives - C and D on the indexer.<BR /> I've defined the D drive for the indexing.<BR /> yet Splunk Folder is using 19GB - I've noticed that the biggest folder is C:\Program Files\Splunk\var\run\searchpeers<BR /> which uses 13GB.</P> <P>what am I missing here ?</P> <P>oh and this indexer is the licenser as well.</P> Sat, 13 Feb 2016 12:07:12 GMT https://community.splunk.com/t5/Deployment-Architecture/Splunk-is-using-the-wrong-disk-for-some-reason-why/m-p/203153#M23678 sbenamro 2016-02-13T12:07:12Z https://community.splunk.com/t5/Deployment-Architecture/Splunk-is-using-the-wrong-disk-for-some-reason-why/m-p/203154#M23679 <P><CODE>$SPLUNK_HOME/var/run/searchpeers</CODE> stores bundles from your search heads used by the indexer to run searches for them with the appropriate configurations. Indexing happens elsewhere, by default in <CODE>$SPLUNK_HOME/var/lib/splunk</CODE> - see if that's fairly small compared to what you've defined on your second drive to confirm that the index path setting is working.</P> <P>As for your searchpeers folder using 13GB, this can have several reasons:<BR /> - is your bundle huge, e.g. massive lookup files?<BR /> - do you have many search heads, each distributing different bundles? Consider merging the search heads into a search head cluster, reducing the number of different bundles on your indexers.<BR /> - are there old bundles from legacy search heads? These can be deleted.</P> Sat, 13 Feb 2016 13:24:10 GMT https://community.splunk.com/t5/Deployment-Architecture/Splunk-is-using-the-wrong-disk-for-some-reason-why/m-p/203154#M23679 martin_mueller 2016-02-13T13:24:10Z