Archive

How to use separate path for Hot, Warm, Cold buckets ?

Engager

We would like to take a back from our buckets.
The backups fails because of high movement of data in HOT Buckets.
We would like to have a separate path for each of the DBs, i.e. something like below setup.

hotPath = $SPLUNK_DB/defaultdb/hotdb
warmPath = $SPLUNK_DB/defaultdb/warmdb
coldPath = $SPLUNK_DB/defaultdb/colddb
thawedPath = $SPLUNK_DB/defaultdb/thaweddb

Please tell us how is the correct way of doing that and support us.
Thank you,

0 Karma

SplunkTrust
SplunkTrust

Hot and warm buckets always share the same path. They cannot be separated.

You should have your backup tool ignore hot buckets. Hot buckets have names beginning with "hot_".

---
If this reply helps you, an upvote would be appreciated.

Engager

Are you sure that is not possible ??

0 Karma

Motivator

This is not possible.
Check out http://docs.splunk.com/Documentation/Splunk/latest/Admin/Indexesconf
You can specify "homePath" (for both the hotdb and the warmdb), but there is neither "hotPath" nor "warmPath".

0 Karma

SplunkTrust
SplunkTrust

Yes, I'm sure.

---
If this reply helps you, an upvote would be appreciated.

Path Finder

Your indexes.conf should look similar to this for each db:
This is a global setting:
[volume:'volume_name']
path = 'path to storage'
maxVolumeDataSizeMB = 'insert size in MB' <-- I believe this is optional

At the index level:
['index_name']
homePath = volume:'volume_name'/db/db

Configure that for each volume and index/db and you should be good.

Hope this helps

0 Karma

Engager

That is not what I want,
I want separate path for HOT and WARM DB so that I can exclude the HOT in backups.

0 Karma

Path Finder

As Rich stated, I don't believe the hot and warm buckets can be separated. If you look at the indexes.conf file, they only give you a homePath, coldPath and thawedPath.
Ex
[volume:hot_warm_storage]
path = /dir/splunk/storage/hot_warm_storage
[volume:cold_storage]
path = /dir/splunk/storage/cold_storage

[test_index]
homePath = volume:hot_warm_storage/test_index/db
coldPath = volume:cold_storage/test_index/colddb

0 Karma

Engager

I belive there should be a way to seprate them

0 Karma

SplunkTrust
SplunkTrust

Contact Splunk support and file an Enhancement Request.

---
If this reply helps you, an upvote would be appreciated.
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!