How to save a certain index to different location on an indexer (not the whole SPLUNK_DB)?

[pashtet13]

I have few noisy indexes that I would like to save to another drive on the Splunk Indexer server. What would be the best way to do it? Splunk documentation only has instructions on how to move the whole SPLUNK_DB, but I don't need that...

Should I create a new variable in splunk-launch.conf (say SPLUNK_DB_TIER2) and update my indexes.conf so it looks like this (and will this work?):

[cisco_asa]
coldPath = $SPLUNK_DB_TIER2\cisco_asa\colddb
homePath = $SPLUNK_DB_TIER2\cisco_asa\db
thawedPath = $SPLUNK_DB_TIER2\cisco_asa\thaweddb

Or can I manually specify the path in indexes.conf without using $ SPLUNK_DB like this:

coldPath = "D:\cisco_asa\colddb"
homePath = "D:\cisco_asa\db"
thawedPath = "D:\cisco_asa\thaweddb"

[somesoni2 · Accepted solution]

If it's just one index you want to move to separate drive, then I would suggest to enter absolute/actual new path for that index in the indexes.conf.

[cisco_asa]
coldPath = D:\cisco_asa\colddb
homePath = D:\cisco_asa\db
thawedPath = D:\cisco_asa\thaweddb
...other settings...

If you want to create a variable/token to refer this large drive, the you can create volume reference and use that for bigger/chattier indexes, like this

[volume:large_indexes]
path = D:\SplunkDb
maxVolumeDataSizeMB = 50000000  #optional, or update per your size

[cisco_asa]
coldPath = volume:large_indexes\cisco_asa\colddb
homePath = volume:large_indexes\cisco_asa\db
thawedPath = volume:large_indexes\cisco_asa\thaweddb
...other settings...

[pashtet13]

Great, thanks!