i would like to run a splunk instance on a unix box. This splunk should receive syslog messages. How do i set up that splunk should store the received data (not the index) on a path that is on a NFS share?
Reason: the box where splunk runs is for the service/search head whereas the storage is on a very different device with lots of space.
In general, I would not recommend nfs as a filesystem to store indexed data on except in very specific circumstances. For hot and warm data, the risk of corruption exceeds my threshold for comfort.