Use NAS as cold storage

[Nawab]

We are using a clustered index environment and want to use NAS as our cold storage.

I mapped NAS to a local folder for linux to be accessable by splunk.

I can see the folders to be mapped on local linux device.

But when i change the configuration on cluster master to use this nas as cold data and push the configuration, splunk some time hang up and stops, even if i restart it it would not work.

Has anyone tried nas as cold storage and can share his fstab and indexex.conf that would be great!

[Nawab]

Hi Manall,

I want to use NAS as read storage i.e as cold not hot.
BTW its work fine with me till now

[marnall]

Are you sure that the NAS is fast enough to receive and write the logs of your Splunk cluster? You need a lot of bandwidth and IOPS, especially if the NAS is being used by multiple indexers at the same time.