Deployment Architecture

Migrating to using volumes in indexes.conf

supersleepwalke
Communicator

Now that Splunk 4.2 introduced the concept of volumes for storing indexes, I'd like to change my configs to use it. (Our storage solution matches their example, fast local RAID 0+1 for hot/warm buckets, a NAS for cold storage.)

Configure index size with volumes

If I change my indexes.conf to using the volume concept, and make sure that they all end up pointing to the same directories as my original config, will that work properly? Will buckets still end up in the same place as before, and retirement still work seamlessly?

1 Solution

jbsplunk
Splunk Employee
Splunk Employee

As long as your volumes are all pointing to the folders you'd like them to use, everything should go seemlessly once you hit the threshold specified for rotation. You will need to restart once you apply these changes.

View solution in original post

jbsplunk
Splunk Employee
Splunk Employee

As long as your volumes are all pointing to the folders you'd like them to use, everything should go seemlessly once you hit the threshold specified for rotation. You will need to restart once you apply these changes.

Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...