Can there ever be a coldPath and homePath without the index name in the path?

[kkancherla]

Is it possible to create an index without having the index name in the cold path and home path?

Example:

[index1]
homePath = /foo/bar/
coldPath = /foo/bar/some/path

What are the best practices around setting these paths that point to a directory on the local file system?

[lguinn2 · Accepted solution]

You can point the paths to any directory you want, BUT the path must be unique. I cannot emphasize this strongly enough.

You CANNOT put the buckets for more than one index in the same directory; this will cause massive problems and probably just make Splunk unusable.

You should not have the same path for the homePath and the coldPath - again this will cause confusion.

The best practice for path naming is to include both the index name and the type of bucket/data that will be contained in the directory. The reason for the index name in the path is so that you know what you are looking at. Here are some examples of patterns that you could use

/volumename/indexname/hotwarm
/volumename/indexname/cold

or

/volumename/home/index1
/volumename/home/index2
/volumename/cold/index1

And of course, "volumename" could be anything you want as well.

I would put the indexes on a local disk - but not the same disk as the operating system and software. Also, if I had the money I would put all of the buckets for an index (hot, warm and cold) on the same logical volume. I would not separate out the cold buckets unless I was forced to do so.

[kkancherla]

Just wondering why splunk lets me create an index without the indexname in the coldPath, shouldn't there be some kind of warning or check in place?
The problem is when the coldToFrozenScript gets called and the path does not have an index name , i have no clue as to which index the bucket belongs to.
Is there a way where splunk can pass the index name as well to the coldToFrozenScript, apart from the path to the bucket?