Getting Data In

how does splunk handle multiple indexes.conf files with volume definitions?

msarro
Builder

I hope this is simple. Most conf files in Splunk, when overlapping in multiple apps, get essentially appended together at runtime. That may be an over simplification but it is the easiest way to understand it for me. How does this function for indexes.conf? Specifically, can I create an indexes.conf file to be included with a deployment client app that includes volume definitions (setting the size of hot and cold) that are common to all indexers, and then when we deploy other apps to my indexers, include a supplementary indexes.conf which only defines new indexes, and whose definitions refer to the hot and cold volumes defined in the deployment client, but don't themselves contain the volume definition? We must use volume definitions instead of static index sizes due to constantly changing source data specifications and the amount of data we deal with.

Any advice would be appreciated. I am hoping this isn't a rtfm type thing but I couldn't find the answer in the docs.

Tags (1)

JSapienza
Contributor

Yes you can , File precedence is as follows:

  1. System local directory -- highest priority
  2. App local directories
  3. App default directories
  4. System default directory -- lowest priority

http://docs.splunk.com/Documentation/Splunk/5.0.3/Admin/Wheretofindtheconfigurationfiles

Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...