Getting Data In

Can we create a symbolic link for only search peer bundles in indexers?


Suppose splunk is installed in the path called SPLUNK_HOME/etc/.... and the search peers bundles are located the SPLUNK_HOME/var/run/searchpeers.But always it gets fill which leads to stopping the indexer to index the I want to create a symbolic link for that searchpeers bundles to other location(or drive),the path is abc/splunk.So that I should not get the space full due to search peers bundles again.
1) the search heads are in clusters and indexers are not?
2)Is it possible to create the symlink only for searchpeers to the path abc/splunk without any consequences?
2)will there be any problem related to anything after creating a symlink to searchpeers?

0 Karma


As long at it is a local symlink it's fine.

You should think of blacklisting lookups from the bundle. It will help. If you do so, you'll need to use local=true when using lookups

0 Karma
Get Updates on the Splunk Community!

Streamline Data Ingestion With Deployment Server Essentials

REGISTER NOW!Every day the list of sources Admins are responsible for gets bigger and bigger, often making the ...

Remediate Threats Faster and Simplify Investigations With Splunk Enterprise Security ...

REGISTER NOW!Join us for a Tech Talk around our latest release of Splunk Enterprise Security 7.2! We’ll walk ...

Introduction to Splunk AI

WATCH NOWHow are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. ...