Getting Data In

Can we create a symbolic link for only search peer bundles in indexers?

divyavikas123
Explorer

Suppose splunk is installed in the path called SPLUNK_HOME/etc/.... and the search peers bundles are located the SPLUNK_HOME/var/run/searchpeers.But always it gets fill which leads to stopping the indexer to index the data.so I want to create a symbolic link for that searchpeers bundles to other location(or drive),the path is abc/splunk.So that I should not get the space full due to search peers bundles again.
1) the search heads are in clusters and indexers are not?
2)Is it possible to create the symlink only for searchpeers to the path abc/splunk without any consequences?
2)will there be any problem related to anything after creating a symlink to searchpeers?

0 Karma

valiquet
Contributor

As long at it is a local symlink it's fine.

You should think of blacklisting lookups from the bundle. It will help. If you do so, you'll need to use local=true when using lookups

0 Karma
Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...