https://community.splunk.com/t5/Monitoring-Splunk/Moving-the-audit-index/m-p/136871#M1619 <P>I need to move just the _audit index from the c drive to a d drive on a windows server.</P> <P>How do I do that? I found an article on pre-6.0 but can't find anything for Splunk 6.0</P> Mon, 11 Nov 2013 16:54:23 GMT peter_gianusso 2013-11-11T16:54:23Z https://community.splunk.com/t5/Monitoring-Splunk/Moving-the-audit-index/m-p/136871#M1619 <P>I need to move just the _audit index from the c drive to a d drive on a windows server.</P> <P>How do I do that? I found an article on pre-6.0 but can't find anything for Splunk 6.0</P> Mon, 11 Nov 2013 16:54:23 GMT https://community.splunk.com/t5/Monitoring-Splunk/Moving-the-audit-index/m-p/136871#M1619 peter_gianusso 2013-11-11T16:54:23Z https://community.splunk.com/t5/Monitoring-Splunk/Moving-the-audit-index/m-p/136872#M1620 <P>create $SPLUNK_HOME/etc/system/local/indexes.conf and add these lines:</P> <PRE><CODE>[_audit] homePath = $SPLUNK_DB/audit/db coldPath = $SPLUNK_DB/audit/colddb thawedPath = $SPLUNK_DB/audit/thaweddb tstatsHomePath = volume:_splunk_summaries/audit/datamodel_summary </CODE></PRE> <P>Change the paths as you wish. Stop splunk, copy/move the files to the new location, start splunk.</P> Mon, 11 Nov 2013 18:59:20 GMT https://community.splunk.com/t5/Monitoring-Splunk/Moving-the-audit-index/m-p/136872#M1620 jtrucks 2013-11-11T18:59:20Z