I am trying to move the index for the okta app to a different location than what it installed as. When i do this splunk will not start. the setting for the app index seems also to be coming from the indexes.conf in the default folder of the app. any suggestions to move the index location would be greatly appreciated.
this app is not getting all of its settings from 1 indexes.conf file. I ended putitng the specific directories in the default indexes.comf and the size settings in the app/local indexes.conf it should not work this but it is.
In the local
folder for the app, create a new indexes.conf
.
In the new indexes.conf
, set the following attributes for the index (look at the indexes.conf
in the default
folder to be sure of the names)
[the_index_name]
homePath = whereyouwanttheindex/db
coldPath = whereyouwanttheindex/colddb
thawedPath = whereyouwanttheindex/thaweddb
Make sure that you specify an absolute path for each of the three attributes.
Stop Splunk
Copy the contents of the index directory from its current location to the new location. Use cp -rp
on Unix - you must copy recursively and preserve permissions.
Start Splunk and make sure that the index is okay and using the new location.
Remove the old directories.
In the documentation: Move the index database