We would like to take a back from our buckets.
The backups fails because of high movement of data in HOT Buckets.
We would like to have a separate path for each of the DBs, i.e. something like below setup.
hotPath = $SPLUNK_DB/defaultdb/hotdb
warmPath = $SPLUNK_DB/defaultdb/warmdb
coldPath = $SPLUNK_DB/defaultdb/colddb
thawedPath = $SPLUNK_DB/defaultdb/thaweddb
Please tell us how is the correct way of doing that and support us.
Hot and warm buckets always share the same path. They cannot be separated.
You should have your backup tool ignore hot buckets. Hot buckets have names beginning with "hot_".
This is not possible.
Check out http://docs.splunk.com/Documentation/Splunk/latest/Admin/Indexesconf
You can specify "homePath" (for both the hotdb and the warmdb), but there is neither "hotPath" nor "warmPath".
Your indexes.conf should look similar to this for each db:
This is a global setting:
path = 'path to storage'
maxVolumeDataSizeMB = 'insert size in MB' <-- I believe this is optional
At the index level:
homePath = volume:'volume_name'/db/db
Configure that for each volume and index/db and you should be good.
Hope this helps
As Rich stated, I don't believe the hot and warm buckets can be separated. If you look at the indexes.conf file, they only give you a homePath, coldPath and thawedPath.
path = /dir/splunk/storage/hot_warm_storage
path = /dir/splunk/storage/cold_storage
homePath = volume:hot_warm_storage/test_index/db
coldPath = volume:cold_storage/test_index/colddb