What is the index settings path and can I modify it?

[summitsplunk]

Hello,

I spun up an Ubuntu Linux box on Amazon EC2. My primary hard drive is 30gb and I also attached a 4tb ebs drive attached to the instance.

My Index Settings Path is currently set to: /opt/splunk/var/lib/splunk (which I believe is the default).

My question is can I tell Splunk to send all of the data to the 4tb drive even if Splunk itself is installed on the root drive?

I'm very new to Splunk and Linux, so sorry if this is a dumb question.

[gcusello · Accepted solution]

Hi summitsplunk,
if you want to modify the path of all indexes, you have to change a global parameter called SPLUNK_DB that you can find in /opt/splunk/etc/splunk-launch.conf.
You can modify it only by CLI and restarting Splunk.

If instead you want to modify one or more indexes you have to use the following procedure:

• stop Splunk on Indexer,
• modify indexes.conf of the index App, inserting the new path,
• copy the existing index folder in the new location,
• restart splunk.

This is for stand alone indexers, if you have a cluster it more complicate and I suggest to follow the procedure described in
http://docs.splunk.com/Documentation/Splunk/7.0.0/Indexer/Clusterdeploymentoverview

Bye.
Giuseppe