topic Re: store collected syslog data on NFS in Getting Data In

store collected syslog data on NFS

dominiquevocat — Wed, 25 May 2011 08:46:51 GMT

Hi,

i would like to run a splunk instance on a unix box. This splunk should receive syslog messages. How do i set up that splunk should store the received data (not the index) on a path that is on a NFS share?

Reason: the box where splunk runs is for the service/search head whereas the storage is on a very different device with lots of space.

Re: store collected syslog data on NFS

MuS — Wed, 25 May 2011 08:52:54 GMT

Hi dominiquevocat

take a look here http://splunk-base.splunk.com/answers/24863/where-splunk-store-syslog-data it's about the same.

regards

Re: store collected syslog data on NFS

dominiquevocat — Wed, 25 May 2011 09:16:32 GMT

Saw it too late but yeah, fits the bill. Thank you anyway.

Re: store collected syslog data on NFS

jbsplunk — Wed, 25 May 2011 15:26:58 GMT

In general, I would not recommend nfs as a filesystem to store indexed data on except in very specific circumstances. For hot and warm data, the risk of corruption exceeds my threshold for comfort.

http://splunk-base.splunk.com/answers/250/can-splunk-read-data-to-index-off-an-nfs-mount-can-splunk-store-indexed-data-to-an-nfs-mount