To change the default data model location and cache manager location( smart store enabled) on an indexer I see we have 2 options.
1) Updating splunk-launch.conf with SPLUNK_DB =<custom file system where hot-buckets are stored > (/splunkdata/data/internal)
2) Updating path of stanza volume:_splunk_summaries
> SPLUNK_HOME/etc/slave-apps/_cluster/local/indexes.conf
[volume:_splunk_summaries]
path = /splunkdata/data/internal
> SPLUNK_HOME/etc/system/default/indexes.conf
[volume:_splunk_summaries]
path = $SPLUNK_DB
Do we have to change in both splunk-launch.conf and indexes.conf, If we have an update only one of the above options what is recommended way also what are pros and cons for updating one of them .
It's been my experience that most customers leave $SPLUNK_DB commented out in splunk-launch.conf and let the index locations be specified by index.conf files.
When you change the default location you are also changing the expected location of existing indexes and/or summaries. Therefore, it's important to move the existing files to the new location. The sequence is: