What is the proper indexes.conf syntax for moving colddb to another volume?

[Michael]

I would just like to confirm my syntax... I've read a bunch of postings, I've RTFM, but none have an actual sample or example of what's needed in the int (that I've found).

I've stopped Splunk.
Moved the colddb from old location to new location.
Edited /opt/splunk/etc/system/local/indexes.conf and added the following:
coldPath = /newspace/colddb
coldPath.maxDataSizeMB = 409600
And restarted Splunk.

That's it, in a nutshell, right? (assuming a 500 gig drive).

Please let me know if that 's wrong...

thanks!
Mike

[MuS]

Hi Mike,

in a nutshell it is as simple as this:

1. Stop Splunk
2. Copy colddb from $SPLUNK_DB//colddb to /newspace/colddb

3. Edited /opt/splunk/etc/system/local/indexes.conf and add the following for the index:

   coldPath = /newspace/colddb

4. Restart Splunk

You can also verify your setting were applied by running this command from the CLI:

 $SPLUNK_HOME/bin/splunk cmd btool splunk cmd btool --debug indexes list <index_name>

With this you can verify if your settings is not over-written by some other indexes.conf, see the docs for more details on this http://docs.splunk.com/Documentation/Splunk/6.3.0/Admin/Wheretofindtheconfigurationfiles

Hope this helps...

cheers, MuS