I have a question related to defining volumes especially the coldvolume in our case. I want to point the coldvolume to a unique location on network attached storage.
Example we have 3 indexers with the following hostnames idx01 idx02 idx03
say we have a local mount point on every indexer which points to the NAS mynas
/mnt/coldvolume -> nfs://mynas
Option 1 Can I then define a volume in /etc/system/local/indexes.conf on every indexer.
On idx01: [volume:coldvolume] path = /mnt/coldvolume/idx01/
On idx02 [volume:coldvolume] path = /mnt/coldvolume/idx02/
On idx03 [volume:coldvolume] path = /mnt/coldvolume/idx03/
The indexes that are then distributed to all indexers in this cluster are of the format [myniceindex] coldPath = volume:coldvolume/myniceindex/colddb
Option 2 As an alternative I can also mount to the subfolders on the NAS by modifying /etc/fstab and letting the /mnt/coldvolume point to nfs://mynas/idx{01,02,03}
I can then distribute the volume definition to all 3 indexers like this [volume:coldvolume] path = /mnt/coldvolume/
Question: Is option 1 a valid / supported configuration for a Splunk indexer cluster? Question: Or is option 2 the best practice?
