Getting Data In

Configuring Cold To Frozen path if cold is on a C: drive and I want my frozen path to be on a newly created F: drive

dbatts
Explorer

I created a new F: drive for my archiving or Frozen path. Currently everything is configured to the default and filling up my C: drive. How do I configure my indexes.conf to have my coldtofrozenpath to be on the F: drive?

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi dbatts,
you can put indexes.conf in one app (custom or default) or in $SPLUNK_HOME/etc/system/local (but I don't like!).
I usually put each of them in the related App.
So You can insert in your indexes.conf a stanza like this:

[my_index]

homePath   = C:\splunk_data\my_index\db
coldPath   = F:\splunk_data\my_index\colddb
thawedPath = F:\splunk_data\my_index\thaweddb

don't use spaces in path.

For other information see https://docs.splunk.com/Documentation/Splunk/7.0.1/Admin/Indexesconf

Bye.
Giuseppe

P.S.:
I usually use Windows only for test, never for production environments!

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi dbatts,
you can put indexes.conf in one app (custom or default) or in $SPLUNK_HOME/etc/system/local (but I don't like!).
I usually put each of them in the related App.
So You can insert in your indexes.conf a stanza like this:

[my_index]

homePath   = C:\splunk_data\my_index\db
coldPath   = F:\splunk_data\my_index\colddb
thawedPath = F:\splunk_data\my_index\thaweddb

don't use spaces in path.

For other information see https://docs.splunk.com/Documentation/Splunk/7.0.1/Admin/Indexesconf

Bye.
Giuseppe

P.S.:
I usually use Windows only for test, never for production environments!

nickhills
Ultra Champion

In indexes.conf for your given index you should set:

coldToFrozenDir = f:\Splunk\data\yourindexName

You need to set this to a path (not just a drive letter) and you may want to specify your index name to help keep things tidy.
See: https://docs.splunk.com/Documentation/Splunk/7.0.1/Admin/Indexesconf#PER_INDEX_OPTIONS

If my comment helps, please give it a thumbs up!
0 Karma
Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Building Momentum: Splunk Developer Program at .conf25

At Splunk, developers are at the heart of innovation. That’s why this year at .conf25, we officially launched ...