We are trying to set two separate locations to store hot/warm and cold indexes. We see the $splunk_db field value in the splunk-launch.conf file currently it is set to SPLUNK_DB=E:\Splunkdata\Indexes. So for a entry in indexes.conf could we do the following:
What we hope to do:
we want to store the home path on dedicated storage on drive E and the cold on SAN storage drive F. Is the above possible?
Alternatively could we set something like the below up in splunk-launch.conf:
and in indexes.conf have the following:
Is either of these two methods possible? Is one recommended?
yes that's what I meant. Currently your paths just show up as one long string with no way of telling where they are new sub-directories.
you have: thawedPath=$SPLUNK_DBakamaithaweddb
I'm guessing it should be: thawedPath=$SPLUNK_DB\/akamai\/thaweddb
In general, putting hot/warm and cold on two different storage volumes is possible and fairly common. You could say that's a main purpose of having warm and cold separated.
I'm not 100% certain whether Splunk will recognize custom additional variables or not, just give it a shot with a temporary testing index. If that works then you should use the variable to simplify changes.
A fully qualified path will always work, you should test using a second variable though if you expect a large number of settings to be based on that. Otherwise you will have maintenance hell down the road.