Deployment Architecture

How do i configure a Splunk cold data path for separate indexers(peers) in an indexer cluster?

New Member

I currently have 4 indexers. I have a new mount drive that I am trying to send Splunk cold data to.

coldpath = /mnt/splunk_cold

Please can anyone explain how I can set this stanza in the cluster master (master app) for each individual indexers? Since the slave app has a higher precedence the system/local...

0 Karma


I configured the volumes as follows:

Create a directory (called as an app in splunk world) for example index_definitionsunder $SPLUNK_HOME/etc/master-apps

Create a local directory under index_definitions and place indexes.conf file here with below stanzas for defining volumes,

# VOLUME Settings - One volume for hot/warm , one for cold
path = /mnt/splunk_hot

path = /mnt/cold

# INDEX settings 
homePath   = volume:hotwarm/index1/db
coldPath   = volume:cold/index1/colddb
thawedPath = $SPLUNK_DB/index1/thaweddb

homePath   = volume:hotwarm/index2/db
coldPath   = volume:cold/index2/colddb
thawedPath = $SPLUNK_DB/index2/thaweddb

Once you have everything in place with right settings, push the bundle to indexers. On cluster master run the command /splunk/bin/splunk apply cluster-bundle -auth admin:password --answer-yes

NOTE: You should also have other mandatory settings in addition to above. Please refer to indexes.conf for more detailed explanation.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!