I need to move just the _audit index from the c drive to a d drive on a windows server.
How do I do that? I found an article on pre-6.0 but can't find anything for Splunk 6.0
create $SPLUNK_HOME/etc/system/local/indexes.conf and add these lines:
homePath = $SPLUNK_DB/audit/db
coldPath = $SPLUNK_DB/audit/colddb
thawedPath = $SPLUNK_DB/audit/thaweddb
tstatsHomePath = volume:_splunk_summaries/audit/datamodel_summary
Change the paths as you wish. Stop splunk, copy/move the files to the new location, start splunk.
View solution in original post