How to change modinputs checkpoints location

[MIJ75]

Hi,

We are looking to change the location of the modinputs checkpoints.
By default, the checkpoints are in $SPLUNK_HOME/var/lib/splunk/modinputs/
I did not find any parameter to change this.
Do you know if/how we can do this?

FYI, the needs comes from our citrix servers, they start on a golden image, but have their eventlogs in a persistent location (D drive). So each time the sever reboot, we loose the checkpoints and all the events in the eventlogs are forwarded, so we have duplicate events in splunk. We'd like to define the location of the checkpoints to the persistent location.

If not possible we'll have to use the current_only parameter in the input, but we'll lose some startup event and we'd like to avoid this.

Thanks
Michael

[jconger]

I haven't tested this, but a symbolic link may work. Link either the entire modinputs folder, or individual subfolders to a folder on your 😧 drive. This would require a change on your PVS or MCS golden image though.

[MIJ75]

Yes, we thought about this option. Not tested yet. I'll check with the citrix admin.
But I would check if we can change this default path with a config file or something before doing this.

Thanks for your input.

[MIJ75]

Just to let you know. We have tested the symbolic links and all is working as expected.
Thanks