How to set different frozen locations for each indexer on a distributed environment

[arrangineni]

We am trying to roll of the frozen data from three indexers to a NFS mount directory which contains three sub-directories with indexer names. Whenever I am trying to create new index and define the frozen path, need to manually define the coldToFrozenDir on each Indexers as they must be pointing to the sub-directories on the mounts instead of main directory.

Is there a an option within indexes.conf to get this automated so we can deploy using our DS?

IDX1: /abc/frozen/idx1
IDX2:/abc/frozen/idx2
IDX2:/abc/frozen/idx3

[nickhills]

Its not in the docs, but have you tried using $HOSTNAME at the end of the path?

[somesoni2 · Accepted solution]

In indexes.conf, we have two options for rolling of frozen data, one is the coldToFrozenDir which you use here and other is coldToFrozenScript in which you define a script to move the buckets to be frozen. So, you can use that and your script can dynamically take the current host (which is the indexer where buckets are frozen) and create/add rolled bucket to respective directory in NFS.

https://docs.splunk.com/Documentation/Splunk/8.0.1/Admin/Indexesconf

A sample (for reference) script can be found here:
https://answers.splunk.com/answers/338594/does-anyone-have-a-working-example-of-coldtofrozen.html