Getting Data In

Can we create a symbolic link for only search peer bundles in indexers?

divyavikas123
Explorer

Suppose splunk is installed in the path called SPLUNK_HOME/etc/.... and the search peers bundles are located the SPLUNK_HOME/var/run/searchpeers.But always it gets fill which leads to stopping the indexer to index the data.so I want to create a symbolic link for that searchpeers bundles to other location(or drive),the path is abc/splunk.So that I should not get the space full due to search peers bundles again.
1) the search heads are in clusters and indexers are not?
2)Is it possible to create the symlink only for searchpeers to the path abc/splunk without any consequences?
2)will there be any problem related to anything after creating a symlink to searchpeers?

0 Karma

valiquet
Contributor

As long at it is a local symlink it's fine.

You should think of blacklisting lookups from the bundle. It will help. If you do so, you'll need to use local=true when using lookups

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...