Deployment Architecture

How do i configure a Splunk cold data path for separate indexers(peers) in an indexer cluster?

New Member

I currently have 4 indexers. I have a new mount drive that I am trying to send Splunk cold data to.

coldpath = /mnt/splunk_cold

Please can anyone explain how I can set this stanza in the cluster master (master app) for each individual indexers? Since the slave app has a higher precedence the system/local...

0 Karma


I configured the volumes as follows:

Create a directory (called as an app in splunk world) for example index_definitionsunder $SPLUNK_HOME/etc/master-apps

Create a local directory under index_definitions and place indexes.conf file here with below stanzas for defining volumes,

# VOLUME Settings - One volume for hot/warm , one for cold
path = /mnt/splunk_hot

path = /mnt/cold

# INDEX settings 
homePath   = volume:hotwarm/index1/db
coldPath   = volume:cold/index1/colddb
thawedPath = $SPLUNK_DB/index1/thaweddb

homePath   = volume:hotwarm/index2/db
coldPath   = volume:cold/index2/colddb
thawedPath = $SPLUNK_DB/index2/thaweddb

Once you have everything in place with right settings, push the bundle to indexers. On cluster master run the command /splunk/bin/splunk apply cluster-bundle -auth admin:password --answer-yes

NOTE: You should also have other mandatory settings in addition to above. Please refer to indexes.conf for more detailed explanation.

0 Karma
Get Updates on the Splunk Community!

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...

Platform Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestIntroducing Splunk Edge Processor, simplified data ...