Moving the _audit index

[peter_gianusso]

I need to move just the _audit index from the c drive to a d drive on a windows server.

How do I do that? I found an article on pre-6.0 but can't find anything for Splunk 6.0

[jtrucks · Accepted solution]

create $SPLUNK_HOME/etc/system/local/indexes.conf and add these lines:

[_audit]
homePath   = $SPLUNK_DB/audit/db
coldPath   = $SPLUNK_DB/audit/colddb
thawedPath = $SPLUNK_DB/audit/thaweddb
tstatsHomePath = volume:_splunk_summaries/audit/datamodel_summary

Change the paths as you wish. Stop splunk, copy/move the files to the new location, start splunk.