Is there any way to globally force all indexes to use a different location for their colddb?

[msarro]

Hi everyone. We have a number of devs working on a test server and are running into issues with space. It would be very helpful if we could somehow force ALL splunk index colddb's to use an external disk.

The only way I know of to do this is with an indexes.conf file. However the problem with that is you need to manually specify the path for the new colddb location. We have indexes constantly being created and removed for testing purposes, and modifying the indexes.conf file requires a restart.

A global command that would automatically say, "by default, all cold db's should be here" would be really helpful.

[sowings]

1) You can use the REST API to create an index on the fly. See http://splunk-base.splunk.com/answers/96233/create-new-index-without-restarting-splunk-indexer.

2) The problem with a specific coldPath setting is that each index will have to have its own, and if they all inherit the same setting, they'll be writing to the same folder and will thereby generate bucket collisions.

3) Try a volume setting instead. By setting volume:cold, you can then reference a handy shorthand when you create the index.

4) Combine points 1 and 3, create a shell script to issue a curl command line REST call to create a new index, and automatically populate the coldPath setting including a volume:cold (and the name of the index as supplied on the command line) to give your developers the flexibility they need.