topic How to change modinputs checkpoints location in Getting Data In

How to change modinputs checkpoints location

MIJ75 — Fri, 10 Aug 2018 09:44:02 GMT

Hi,

We are looking to change the location of the modinputs checkpoints.
By default, the checkpoints are in $SPLUNK_HOME/var/lib/splunk/modinputs/
I did not find any parameter to change this.
Do you know if/how we can do this?

FYI, the needs comes from our citrix servers, they start on a golden image, but have their eventlogs in a persistent location (D drive). So each time the sever reboot, we loose the checkpoints and all the events in the eventlogs are forwarded, so we have duplicate events in splunk. We'd like to define the location of the checkpoints to the persistent location.

If not possible we'll have to use the current_only parameter in the input, but we'll lose some startup event and we'd like to avoid this.

Thanks
Michael

Re: How to change modinputs checkpoints location

jconger — Fri, 10 Aug 2018 13:50:11 GMT

I haven't tested this, but a symbolic link may work. Link either the entire modinputs folder, or individual subfolders to a folder on your 😧 drive. This would require a change on your PVS or MCS golden image though.

Re: How to change modinputs checkpoints location

MIJ75 — Mon, 13 Aug 2018 08:37:46 GMT

Yes, we thought about this option. Not tested yet. I'll check with the citrix admin.
But I would check if we can change this default path with a config file or something before doing this.

Thanks for your input.

Re: How to change modinputs checkpoints location

MIJ75 — Thu, 23 Aug 2018 08:52:13 GMT

Just to let you know. We have tested the symbolic links and all is working as expected.
Thanks