topic Re: indexes.conf and setting volumes globally in Getting Data In

indexes.conf and setting volumes globally

himynamesdave — Tue, 29 Sep 2020 13:40:16 GMT

Hi -

I am re-architecting our Splunk environment. I have mounted various volumes to each of my indexers (3 total) for hot, warm and cold buckets.

To do this I have set volumes in an indexes.conf file I will deploy via Deployment Server to the 3 indexers.

/deployment-apps/myapp/default/indexes.conf

[volume:hot_warm]
path = /splunk_data/hot_warm
#DISK SIZE = 2.9TB
maxVolumeDataSizeMB = 2800000

[volume:cold]
#DISK SIZE = 8.8TB
path = /splunk_data/cold
maxVolumeDataSizeMB = 8700000

My question is, will this config set volumes globally for all indexes on the indexer? That is, if another app has an index=x, will that index write hot data to the path; "/splunk_data/hot_warm", for example?

Re: indexes.conf and setting volumes globally

brreeves_splunk — Thu, 13 Apr 2017 13:10:24 GMT

As long as when you set up homePath=volume:hot_warm/indexname/db/ in each indexes.conf for each index, then yes. homePath is a required value, so that should be easy.

All you've done so far is tell Splunk that there ARE volumes...you haven't yet told an index to use them.

Re: indexes.conf and setting volumes globally

himynamesdave — Thu, 13 Apr 2017 17:48:09 GMT

Is there anyway to set the path to the volumes globally for each indexer, so that each index uses these volumes by default for the appropriate bucket?

Re: indexes.conf and setting volumes globally

brreeves_splunk — Thu, 13 Apr 2017 18:11:00 GMT

I corrected my original answer, but you already HAVE told Splunk that the volumes exist, but the homePath value is required PER index...so not really a way to set that globally. You should have indexes.conf that get deployed with the apps as well where you could update the homePath.