Deployment Architecture

Migrating to using volumes in indexes.conf

supersleepwalke
Communicator

Now that Splunk 4.2 introduced the concept of volumes for storing indexes, I'd like to change my configs to use it. (Our storage solution matches their example, fast local RAID 0+1 for hot/warm buckets, a NAS for cold storage.)

Configure index size with volumes

If I change my indexes.conf to using the volume concept, and make sure that they all end up pointing to the same directories as my original config, will that work properly? Will buckets still end up in the same place as before, and retirement still work seamlessly?

1 Solution

jbsplunk
Splunk Employee
Splunk Employee

As long as your volumes are all pointing to the folders you'd like them to use, everything should go seemlessly once you hit the threshold specified for rotation. You will need to restart once you apply these changes.

View solution in original post

jbsplunk
Splunk Employee
Splunk Employee

As long as your volumes are all pointing to the folders you'd like them to use, everything should go seemlessly once you hit the threshold specified for rotation. You will need to restart once you apply these changes.

Get Updates on the Splunk Community!

Good Sourcetype Naming

When it comes to getting data in, one of the earliest decisions made is what to use as a sourcetype. Often, ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Splunk App for Anomaly Detection End of Life Announcement

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...