is it possible to store buckets in different drives? this is all windows environment
hot buckets on drive D:\
warm buckets on drive E:\
cold buckets on drive F:\
Hot and warm are always in the same directory, however your cold buckets can be stored in a different location.
This can be configured per index in the indexes.conf file by changing the homePath and coldPath settings.
Take a look at the documentation here:
http://docs.splunk.com/Documentation/Splunk/7.0.0/Indexer/Configureindexstorage
As an alternative on Windows, you can specify that a disk be mounted in a directory, as well as being a separate drive. This means you can keep the default directory structure of Splunk without having to adjust your indexes.conf files, but still browse to the data via drive letter.
Have a look at the following technet article for details on how to do this:
https://technet.microsoft.com/en-us/library/cc753321(v=ws.11).aspx
Hot and warm are always in the same directory, however your cold buckets can be stored in a different location.
This can be configured per index in the indexes.conf file by changing the homePath and coldPath settings.
Take a look at the documentation here:
http://docs.splunk.com/Documentation/Splunk/7.0.0/Indexer/Configureindexstorage
As an alternative on Windows, you can specify that a disk be mounted in a directory, as well as being a separate drive. This means you can keep the default directory structure of Splunk without having to adjust your indexes.conf files, but still browse to the data via drive letter.
Have a look at the following technet article for details on how to do this:
https://technet.microsoft.com/en-us/library/cc753321(v=ws.11).aspx
Thank you for the explanation and links.
Hot and warm buckets must be on the same drive. Cold can be elsewhere, as can frozen.