Deployment Architecture

How do i configure a Splunk cold data path for separate indexers(peers) in an indexer cluster?

enmanu
New Member

I currently have 4 indexers. I have a new mount drive that I am trying to send Splunk cold data to.

[volume:cold]
coldpath = /mnt/splunk_cold

Please can anyone explain how I can set this stanza in the cluster master (master app) for each individual indexers? Since the slave app has a higher precedence the system/local...

0 Karma

sudosplunk
Motivator

I configured the volumes as follows:

Create a directory (called as an app in splunk world) for example index_definitionsunder $SPLUNK_HOME/etc/master-apps

Create a local directory under index_definitions and place indexes.conf file here with below stanzas for defining volumes,

# VOLUME Settings - One volume for hot/warm , one for cold
[volume:hotwarm]
path = /mnt/splunk_hot

[volume:cold]
path = /mnt/cold

# INDEX settings 
[index1]
homePath   = volume:hotwarm/index1/db
coldPath   = volume:cold/index1/colddb
thawedPath = $SPLUNK_DB/index1/thaweddb

[index2]
homePath   = volume:hotwarm/index2/db
coldPath   = volume:cold/index2/colddb
thawedPath = $SPLUNK_DB/index2/thaweddb

Once you have everything in place with right settings, push the bundle to indexers. On cluster master run the command /splunk/bin/splunk apply cluster-bundle -auth admin:password --answer-yes

NOTE: You should also have other mandatory settings in addition to above. Please refer to indexes.conf for more detailed explanation.

0 Karma
Get Updates on the Splunk Community!

Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through:An introduction to the Splunk Threat ...

Splunk Life | Happy Pride Month!

Happy Pride Month, Splunk Community! 🌈 In the United States, as well as many countries around the ...

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...