Deployment Architecture

What is the index settings path and can I modify it?

summitsplunk
Communicator

Hello,

I spun up an Ubuntu Linux box on Amazon EC2. My primary hard drive is 30gb and I also attached a 4tb ebs drive attached to the instance.

My Index Settings Path is currently set to: /opt/splunk/var/lib/splunk (which I believe is the default).

My question is can I tell Splunk to send all of the data to the 4tb drive even if Splunk itself is installed on the root drive?

I'm very new to Splunk and Linux, so sorry if this is a dumb question.

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi summitsplunk,
if you want to modify the path of all indexes, you have to change a global parameter called SPLUNK_DB that you can find in /opt/splunk/etc/splunk-launch.conf.
You can modify it only by CLI and restarting Splunk.

If instead you want to modify one or more indexes you have to use the following procedure:

  • stop Splunk on Indexer,
  • modify indexes.conf of the index App, inserting the new path,
  • copy the existing index folder in the new location,
  • restart splunk.

This is for stand alone indexers, if you have a cluster it more complicate and I suggest to follow the procedure described in
http://docs.splunk.com/Documentation/Splunk/7.0.0/Indexer/Clusterdeploymentoverview

Bye.
Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi summitsplunk,
if you want to modify the path of all indexes, you have to change a global parameter called SPLUNK_DB that you can find in /opt/splunk/etc/splunk-launch.conf.
You can modify it only by CLI and restarting Splunk.

If instead you want to modify one or more indexes you have to use the following procedure:

  • stop Splunk on Indexer,
  • modify indexes.conf of the index App, inserting the new path,
  • copy the existing index folder in the new location,
  • restart splunk.

This is for stand alone indexers, if you have a cluster it more complicate and I suggest to follow the procedure described in
http://docs.splunk.com/Documentation/Splunk/7.0.0/Indexer/Clusterdeploymentoverview

Bye.
Giuseppe

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...