https://community.splunk.com/t5/Getting-Data-In/Setting-the-homePath-option-in-indexes-conf-on-Windows/m-p/23235#M3651 <P>This is what I did. I have higher speed drives for the data coming in and then the cold data gets moved to a lower speed / high capacity drive.</P> <P>Make a copy of c:\program files\splunk\etc\system\default\indexes.conf and place it in c:\program files\splunk\etc\system\local\</P> <P>Change the $SPLUNK_DB of the index you want to move.</P> <P>Example:</P> <PRE><CODE>[myindex] homePath = E:\SplunkIndexes-warm\myindex\db coldPath = F:\SplunkIndexes-cold\myindex\colddb thawedPath = F:\SplunkIndexes-thawed\myindex\thaweddb maxMemMB = 20 maxConcurrentOptimizes = 6 maxHotIdleSecs = 86400 maxHotBuckets = 10 maxDataSize = auto_high_volume </CODE></PRE> <P>Once you save the file, restart Splunk and it will move the effected indexes to the new folder/drives.</P> Sat, 31 Jul 2010 03:18:20 GMT treinke 2010-07-31T03:18:20Z https://community.splunk.com/t5/Getting-Data-In/Setting-the-homePath-option-in-indexes-conf-on-Windows/m-p/23234#M3650 <P>On Windows, I want to set the homePath in my indexes.conf file for a new index I created, which is located on my E:\ drive.</P> <P>The online Splunk guides have examples that use </P> <P>homePath = $SPLUNK_HOME/blah/.... </P> <P>but there are no examples of how an actual path on Windows would be specified.</P> <P>I have the following setting in my indexes.conf, which does not seem to work.</P> <P>[myIndex]<BR /> homePath = e:\Splunk_Indexes\myIndex\</P> <P>Assuming my format is incorrect, what is the path supposed to look like so that Splunk used my E:\ drive?</P> Sat, 31 Jul 2010 01:29:37 GMT https://community.splunk.com/t5/Getting-Data-In/Setting-the-homePath-option-in-indexes-conf-on-Windows/m-p/23234#M3650 maverick 2010-07-31T01:29:37Z https://community.splunk.com/t5/Getting-Data-In/Setting-the-homePath-option-in-indexes-conf-on-Windows/m-p/23235#M3651 <P>This is what I did. I have higher speed drives for the data coming in and then the cold data gets moved to a lower speed / high capacity drive.</P> <P>Make a copy of c:\program files\splunk\etc\system\default\indexes.conf and place it in c:\program files\splunk\etc\system\local\</P> <P>Change the $SPLUNK_DB of the index you want to move.</P> <P>Example:</P> <PRE><CODE>[myindex] homePath = E:\SplunkIndexes-warm\myindex\db coldPath = F:\SplunkIndexes-cold\myindex\colddb thawedPath = F:\SplunkIndexes-thawed\myindex\thaweddb maxMemMB = 20 maxConcurrentOptimizes = 6 maxHotIdleSecs = 86400 maxHotBuckets = 10 maxDataSize = auto_high_volume </CODE></PRE> <P>Once you save the file, restart Splunk and it will move the effected indexes to the new folder/drives.</P> Sat, 31 Jul 2010 03:18:20 GMT https://community.splunk.com/t5/Getting-Data-In/Setting-the-homePath-option-in-indexes-conf-on-Windows/m-p/23235#M3651 treinke 2010-07-31T03:18:20Z