Splunk Enterprise

How to Splunk index path change

thkwon
Explorer

Hello 

I want to save hot/warm and cold separately when I make splunk index.

Hot/Warm is stored in /tmp/hotwarm and cold is stored in /tmp/cold path.

However, it is time to create an index in the Splunk UI.

I know to separate routes from indexes.conf. It's just that I want to save it in the UI as Default in the path I want to save.

What should I do?

Thanks

Labels (1)
0 Karma

manjunathmeti
Champion

hi @thkwon,

You can provide the Home path and Cold path in the UI also.
If you don't provide paths, by default home path is set to $SPLUNK_DB/INDEX_NAME/db and cold path is set to $SPLUNK_DB/INDEX_NAME/colddb.
In the system, $SPLUNK_DB is set to $SPLUNK_HOME/var/lib/splunk.

You can override the new $SPLUNK_DB path/tmp/splunk in $SPLUNK_HOME/etc/splunk-launch.conf file.

SPLUNK_DB = /tmp/splunk

 

If this reply helps you, a like would be appreciated.

Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...