We would like to take a back from our buckets.
The backups fails because of high movement of data in HOT Buckets.
We would like to have a separate path for each of the DBs, i.e. something like below setup.
hotPath = $SPLUNK_DB/defaultdb/hotdb
warmPath = $SPLUNK_DB/defaultdb/warmdb
coldPath = $SPLUNK_DB/defaultdb/colddb
thawedPath = $SPLUNK_DB/defaultdb/thaweddb
Please tell us how is the correct way of doing that and support us.
Thank you,
Hot and warm buckets always share the same path. They cannot be separated.
You should have your backup tool ignore hot buckets. Hot buckets have names beginning with "hot_".
Are you sure that is not possible ??
This is not possible.
Check out http://docs.splunk.com/Documentation/Splunk/latest/Admin/Indexesconf
You can specify "homePath" (for both the hotdb and the warmdb), but there is neither "hotPath" nor "warmPath".
Yes, I'm sure.
Your indexes.conf should look similar to this for each db:
This is a global setting:
[volume:'volume_name']
path = 'path to storage'
maxVolumeDataSizeMB = 'insert size in MB' <-- I believe this is optional
At the index level:
['index_name']
homePath = volume:'volume_name'/db/db
Configure that for each volume and index/db and you should be good.
Hope this helps
That is not what I want,
I want separate path for HOT and WARM DB so that I can exclude the HOT in backups.
As Rich stated, I don't believe the hot and warm buckets can be separated. If you look at the indexes.conf file, they only give you a homePath, coldPath and thawedPath.
Ex
[volume:hot_warm_storage]
path = /dir/splunk/storage/hot_warm_storage
[volume:cold_storage]
path = /dir/splunk/storage/cold_storage
[test_index]
homePath = volume:hot_warm_storage/test_index/db
coldPath = volume:cold_storage/test_index/colddb
I belive there should be a way to seprate them
Contact Splunk support and file an Enhancement Request.