Splunk Search

How To move the okta index

mcclaugherty
New Member

I am trying to move the index for the okta app to a different location than what it installed as. When i do this splunk will not start. the setting for the app index seems also to be coming from the indexes.conf in the default folder of the app. any suggestions to move the index location would be greatly appreciated.

Tags (1)
0 Karma

mcclaugherty
New Member

this app is not getting all of its settings from 1 indexes.conf file. I ended putitng the specific directories in the default indexes.comf and the size settings in the app/local indexes.conf it should not work this but it is.

0 Karma

lguinn2
Legend
  • In the local folder for the app, create a new indexes.conf.

  • In the new indexes.conf, set the following attributes for the index (look at the indexes.conf in the default folder to be sure of the names)

    [the_index_name]
    homePath = whereyouwanttheindex/db
    coldPath = whereyouwanttheindex/colddb
    thawedPath = whereyouwanttheindex/thaweddb

Make sure that you specify an absolute path for each of the three attributes.

  • Stop Splunk

  • Copy the contents of the index directory from its current location to the new location. Use cp -rp on Unix - you must copy recursively and preserve permissions.

  • Start Splunk and make sure that the index is okay and using the new location.

  • Remove the old directories.

In the documentation: Move the index database

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...