Splunk Enterprise

How to Splunk index path change

thkwon
Explorer

Hello 

I want to save hot/warm and cold separately when I make splunk index.

Hot/Warm is stored in /tmp/hotwarm and cold is stored in /tmp/cold path.

However, it is time to create an index in the Splunk UI.

I know to separate routes from indexes.conf. It's just that I want to save it in the UI as Default in the path I want to save.

What should I do?

Thanks

Labels (1)
0 Karma

manjunathmeti
Champion

hi @thkwon,

You can provide the Home path and Cold path in the UI also.
If you don't provide paths, by default home path is set to $SPLUNK_DB/INDEX_NAME/db and cold path is set to $SPLUNK_DB/INDEX_NAME/colddb.
In the system, $SPLUNK_DB is set to $SPLUNK_HOME/var/lib/splunk.

You can override the new $SPLUNK_DB path/tmp/splunk in $SPLUNK_HOME/etc/splunk-launch.conf file.

SPLUNK_DB = /tmp/splunk

 

If this reply helps you, a like would be appreciated.

Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...