how does splunk handle multiple indexes.conf files with volume definitions?

msarro — Wed, 26 Jun 2013 12:04:54 GMT

I hope this is simple. Most conf files in Splunk, when overlapping in multiple apps, get essentially appended together at runtime. That may be an over simplification but it is the easiest way to understand it for me. How does this function for indexes.conf? Specifically, can I create an indexes.conf file to be included with a deployment client app that includes volume definitions (setting the size of hot and cold) that are common to all indexers, and then when we deploy other apps to my indexers, include a supplementary indexes.conf which only defines new indexes, and whose definitions refer to the hot and cold volumes defined in the deployment client, but don't themselves contain the volume definition? We must use volume definitions instead of static index sizes due to constantly changing source data specifications and the amount of data we deal with.

Any advice would be appreciated. I am hoping this isn't a rtfm type thing but I couldn't find the answer in the docs.

Re: how does splunk handle multiple indexes.conf files with volume definitions?

JSapienza — Wed, 26 Jun 2013 13:33:41 GMT

Yes you can , File precedence is as follows:

System local directory -- highest priority
App local directories
App default directories
System default directory -- lowest priority

http://docs.splunk.com/Documentation/Splunk/5.0.3/Admin/Wheretofindtheconfigurationfiles

topic how does splunk handle multiple indexes.conf files with volume definitions? in Getting Data In

how does splunk handle multiple indexes.conf files with volume definitions?

Re: how does splunk handle multiple indexes.conf files with volume definitions?