Monitoring Splunk
Highlighted

Moving the _audit index

Communicator

I need to move just the _audit index from the c drive to a d drive on a windows server.

How do I do that? I found an article on pre-6.0 but can't find anything for Splunk 6.0

Tags (2)
0 Karma
Highlighted

Re: Moving the _audit index

Splunk Employee
Splunk Employee

create $SPLUNK_HOME/etc/system/local/indexes.conf and add these lines:

[_audit]
homePath   = $SPLUNK_DB/audit/db
coldPath   = $SPLUNK_DB/audit/colddb
thawedPath = $SPLUNK_DB/audit/thaweddb
tstatsHomePath = volume:_splunk_summaries/audit/datamodel_summary

Change the paths as you wish. Stop splunk, copy/move the files to the new location, start splunk.

View solution in original post