store collected syslog data on NFS

[dominiquevocat]

Hi,

i would like to run a splunk instance on a unix box. This splunk should receive syslog messages. How do i set up that splunk should store the received data (not the index) on a path that is on a NFS share?

Reason: the box where splunk runs is for the service/search head whereas the storage is on a very different device with lots of space.

[jbsplunk]

In general, I would not recommend nfs as a filesystem to store indexed data on except in very specific circumstances. For hot and warm data, the risk of corruption exceeds my threshold for comfort.

http://splunk-base.splunk.com/answers/250/can-splunk-read-data-to-index-off-an-nfs-mount-can-splunk-...

[MuS · Accepted solution]

Hi dominiquevocat

take a look here http://splunk-base.splunk.com/answers/24863/where-splunk-store-syslog-data it's about the same.

regards

[dominiquevocat]

Saw it too late but yeah, fits the bill. Thank you anyway.