Who to split up $SPLUNK_DB and colddb

[hartfoml]

I have many indexes on my three indexers. I have attached NSF shares for the colddb. All the indexes are at $SPLUNK_DB/indexname/colddb.

If I stop splunk and copy all the cold buckets to a new share
rsync -Rv --archive */colddb/* /mnt/cs-1/splunk/
How can I pint splunk to the new location at startup?

[lycollicott · Accepted solution]

Edit your indexes.conf file and change the cold setting for each index.

For example, change this"

coldPath   = $SPLUNK_DB\defaultdb\colddb

to this:

coldPath =\your_newpath\defaultdb\colddb

[lycollicott]

Let me clarify something for you ....

1. Stop splunk first
2. Do your rsync
3. Edit indexes.conf
4. Start splunk.

[hartfoml]

Part of what @lycollicott suggested solved my problem I created a new veritable in splunk-launch.conf then did a global search and replace in all the indexes.conf for the new veritable to the "colddb = $SPLUNK_COLDDB" This will have to be changed for every new index that is created in the future.

[hartfoml]

thanks but there are many indexes.conf to edit. I was looking for something that would change the default behavior. Perhaps something in the splunk-launch.conf where the defualt SPLUNK_DB is located?

Thanks for the response.

[lycollicott]

Now, wait a minute. Your post indicated that you wanted to move only colddb, right? Well, it you change the value of SPLUNK_DB (which is possible) then that affects your hot/warm buckets as well as cold.

If you want to relocate only your colddb buckets then you have to edit the indexes.conf file.

[hartfoml]

thanks that is the answer I was hoping not to get. I was hoping someone had a way to address where the cold buckets were without having to edit all the indexes.conf for all the the apps that have been installed along with all the data sources that have been added. looks like 86 different indexes to edit in about 14 different indexes.conf files and some are default so I will have to create some new indexes.conf. I was hoping for a better answer that the one you provided.

Thanks for your help 🙂

[lycollicott]

I have never tried this myself, but I wonder if you could create a new variable SPLUNK_COLDDB in splunk-launch.conf. Unfortunately you would still have to edit indexes.conf.

[hartfoml]

That is a great idea. I will try it.

Create Veritable called SPLUNK_COLDDB in splunk-launch.conf
Replace "coldPath = $SPLUNK_DB" with "coldPath = $SPLUNK_COLDDB" in 84 locations

Is there a way to change the default coldPath for newly created indexes

[lycollicott]

I just tried a new variable and it did work. LOL, give me some karma HaHa

[ebwong]

Is there another configuration file that I can set the $COLD_DB Variable in so that I can "override" the default configuration from an app?

[lycollicott]

I doubt it.