Knowledge Management

Is it possible to change dump folder on a windows splunk ent. instance?

linspec9721
Explorer

Hello all,

how is possible to change default dump folder on Windows?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @linspec9721,

as @Azeemering asked, what do you mean with "dump folder"?

Anyway, on Splunk you can modify the installation folder (called $SPLUNK_HOME) and the folder containing the indexes (called $SPLUNK_DB).

The folder containing temporary files ($SPLUNK_HOME/var/run) isn't changeable.

Ciao.

Giuseppe

0 Karma

linspec9721
Explorer

Hello @Azeemering @gcusello,

I mean the crash dump folder.

Is it possibile to change the /var/log/splunk folder path?

I am on 9.0.0.

Thank you

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @linspec9721,

for my knowldege, the only changeable folders are the installation folder (called $SPLUNK_HOME) and the folder containing the indexes (called $SPLUNK_DB), not others.

Why do you want to change it?

in this way, crash logs are indexed by Splunk and you maintain them.

Ciao.

Giuseppe

linspec9721
Explorer

Hi,

sometimes it happens that crash dumps fill up the partion of $SPLUNK_HOME and we need to manually clean it.

Thank you.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @linspec9721,

this means that you have a very narrow filesystem, maybe it could be a good idea giving a little more space to your file system.

Anyway, I suppose that it isn't so frequent a crash of your system, so deleting crash log files isn't a so frequent job.

Ciao.

Giuseppe

0 Karma

Azeemering
Builder

What do you mean? I don't understand your question.

Please read this:
https://docs.splunk.com/Documentation/SplunkCloud/8.2.2203/SearchReference/Dump

0 Karma
Get Updates on the Splunk Community!

Learn Splunk Insider Insights, Do More With Gen AI, & Find 20+ New Use Cases You Can ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Buttercup Games: Further Dashboarding Techniques (Part 7)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...