Getting Data In

how does splunk handle multiple indexes.conf files with volume definitions?


I hope this is simple. Most conf files in Splunk, when overlapping in multiple apps, get essentially appended together at runtime. That may be an over simplification but it is the easiest way to understand it for me. How does this function for indexes.conf? Specifically, can I create an indexes.conf file to be included with a deployment client app that includes volume definitions (setting the size of hot and cold) that are common to all indexers, and then when we deploy other apps to my indexers, include a supplementary indexes.conf which only defines new indexes, and whose definitions refer to the hot and cold volumes defined in the deployment client, but don't themselves contain the volume definition? We must use volume definitions instead of static index sizes due to constantly changing source data specifications and the amount of data we deal with.

Any advice would be appreciated. I am hoping this isn't a rtfm type thing but I couldn't find the answer in the docs.

Tags (1)


Yes you can , File precedence is as follows:

  1. System local directory -- highest priority
  2. App local directories
  3. App default directories
  4. System default directory -- lowest priority

Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...