topic Re: Who to split up $SPLUNK_DB and colddb in Getting Data In

Who to split up $SPLUNK_DB and colddb

hartfoml — Mon, 25 Jul 2016 19:57:38 GMT

I have many indexes on my three indexers. I have attached NSF shares for the colddb. All the indexes are at $SPLUNK_DB/indexname/colddb.

If I stop splunk and copy all the cold buckets to a new share
rsync -Rv --archive */colddb/* /mnt/cs-1/splunk/
How can I pint splunk to the new location at startup?

Re: Who to split up $SPLUNK_DB and colddb

lycollicott — Mon, 25 Jul 2016 20:04:20 GMT

Edit your indexes.conf file and change the cold setting for each index.

For example, change this"

coldPath   = $SPLUNK_DB\defaultdb\colddb

to this:

coldPath =\your_newpath\defaultdb\colddb

Re: Who to split up $SPLUNK_DB and colddb

lycollicott — Mon, 25 Jul 2016 20:04:52 GMT

Let me clarify something for you ....

Stop splunk first
Do your rsync
Edit indexes.conf
Start splunk.

Re: Who to split up $SPLUNK_DB and colddb

hartfoml — Tue, 26 Jul 2016 12:11:06 GMT

thanks but there are many indexes.conf to edit. I was looking for something that would change the default behavior. Perhaps something in the splunk-launch.conf where the defualt SPLUNK_DB is located?

Thanks for the response.

Re: Who to split up $SPLUNK_DB and colddb

lycollicott — Tue, 26 Jul 2016 12:28:58 GMT

Now, wait a minute. Your post indicated that you wanted to move only colddb, right? Well, it you change the value of SPLUNK_DB (which is possible) then that affects your hot/warm buckets as well as cold.

If you want to relocate only your colddb buckets then you have to edit the indexes.conf file.

Re: Who to split up $SPLUNK_DB and colddb

hartfoml — Tue, 26 Jul 2016 16:25:14 GMT

thanks that is the answer I was hoping not to get. I was hoping someone had a way to address where the cold buckets were without having to edit all the indexes.conf for all the the apps that have been installed along with all the data sources that have been added. looks like 86 different indexes to edit in about 14 different indexes.conf files and some are default so I will have to create some new indexes.conf. I was hoping for a better answer that the one you provided.

Thanks for your help 🙂

Re: Who to split up $SPLUNK_DB and colddb

lycollicott — Tue, 26 Jul 2016 16:35:49 GMT

I have never tried this myself, but I wonder if you could create a new variable SPLUNK_COLDDB in splunk-launch.conf. Unfortunately you would still have to edit indexes.conf.

Re: Who to split up $SPLUNK_DB and colddb

hartfoml — Tue, 29 Sep 2020 10:22:24 GMT

That is a great idea. I will try it.

Create Veritable called SPLUNK_COLDDB in splunk-launch.conf
Replace "coldPath = $SPLUNK_DB" with "coldPath = $SPLUNK_COLDDB" in 84 locations

Is there a way to change the default coldPath for newly created indexes

Re: Who to split up $SPLUNK_DB and colddb

lycollicott — Tue, 26 Jul 2016 17:37:56 GMT

I doubt it.

Re: Who to split up $SPLUNK_DB and colddb

lycollicott — Tue, 26 Jul 2016 19:31:27 GMT

I just tried a new variable and it did work. LOL, give me some karma HaHa

Re: Who to split up $SPLUNK_DB and colddb

hartfoml — Tue, 26 Jul 2016 20:19:12 GMT

Part of what @lycollicott suggested solved my problem I created a new veritable in splunk-launch.conf then did a global search and replace in all the indexes.conf for the new veritable to the "colddb = $SPLUNK_COLDDB" This will have to be changed for every new index that is created in the future.

Re: Who to split up $SPLUNK_DB and colddb

ebwong — Wed, 17 Nov 2021 19:30:19 GMT

Is there another configuration file that I can set the $COLD_DB Variable in so that I can "override" the default configuration from an app?