topic Re: change the indexer location in Getting Data In

change the indexer location

splunker_123 — Mon, 16 Jul 2012 15:27:46 GMT

I have installed splunk indexer on a linux machine under installation directory /opt and there are quite a few forwarders sending data to this indexer

Later on we decided to move the indexer to a NAS storage,so now I have to point the indexer to store the data in NAS storage not under /opt.The data indexeed so far are test data so I'm not worried about the data transfer,just I need to point the indexer to NAS storage so that new data will be stored over there
what are the changes I've to make please?

Re: change the indexer location

Kate_Lawrence-G — Mon, 16 Jul 2012 17:47:47 GMT

Hi,

You need to change the directories in local/indexes.conf to point to where you want the hot/warm, cold and frozen data to reside and restart splunk.

Re: change the indexer location

splunker_123 — Tue, 24 Jul 2012 13:46:32 GMT

Hi
I dont have indexes.conf under etc/local but I've in the below locations

Should I copy the indexes.conf under default dir and put it under local directory then change there? If so should the change the path under default as well?

etc/apps/SplunkDeploymentMonitor/default/indexes.conf
etc/apps/sample_app/default/indexes.conf
etc/apps/SplunkLightForwarder/default/indexes.conf
etc/system/default/indexes.conf

Re: change the indexer location

Kate_Lawrence-G — Tue, 24 Jul 2012 14:00:23 GMT

Hi,

You can just place a copy on the local directory and edit it with the settings you need.
The local copy will take precedence over the default copy once splunk is restart and apply your changes.

Re: change the indexer location

splunker_123 — Tue, 24 Jul 2012 14:20:03 GMT

Thanks again....OK If I take a copy of indexes.conf and edit the new path for indexer and put it under local directory it should work.My concern is ,in the longer run,if someone accidently deletes the indexes.conf file under local directory then still there will be indexes.conf under default directory so at that point of time data will be written to the old path again.Inorder to avoid this to happen can I edit the indexes.conf under default directory as well? or is there any other option you can think of?

Old path is -->/opt
new path is-->/apps -this is a NAS filer.

Re: change the indexer location

Kate_Lawrence-G — Tue, 24 Jul 2012 14:33:23 GMT

No problem, you can either:

Make the local file immutable (chattr +i) this will prevent any accidental changes/deletions to the file as the immutable flag would have to be removed prior to changes.
Keep both file identical (just be careful of changes - like adding summary indexes or new indexes)

Re: change the indexer location

yannK — Tue, 24 Jul 2012 15:07:45 GMT

yes, recreate the indexes.conf definition (just the paths) in the local folder.

example
[myindex]
homePath= ...
coldPath= ...
frozenPath = ....

Re: change the indexer location

splunker_123 — Tue, 24 Jul 2012 15:59:52 GMT

Wonderful ..Thank you...Regarding the apps in splunk,we have enabled monitoring so the indexes.conf file inside SplunkDeploymentMonitor apps has got the same precedence there as well? Can I make a copy of indexes.conf from /opt/splunk/etc/apps/SplunkDeploymentMonitor/default to local and change the path in both files make it identical because I've changed the main indexes file now but still summary_* indexers are pointing to old location?

Re: change the indexer location

Kate_Lawrence-G — Tue, 24 Jul 2012 16:28:02 GMT

Yes the same logic should apply to the deployment server indexes.

Re: change the indexer location

splunker_123 — Wed, 25 Jul 2012 09:11:09 GMT

Thank you so much for your help