Override location of summary index?

[msarro]

Hi everyone. I am trying to move the location of the summary index from local disk to a SAN mount. I have written an app that includes an appname/default/indexes.conf file with the following (i have also tried placing in appname/local/indexes.conf):

[volume:HOT]
path=/splunk/hot
maxVolumeDataSizeMB=960000

[volume:COLD]
path=/splunk/cold
maxVolumeDataSizeMB=960000

[SUMMARY]
disabled=false
homePath=volume:HOT/summary
coldPath=volume:COLD/summary
thawedPath=/splunk/thawed/summary
maxDataSize=auto

However, when trying to start up splunk after this app has been deployed, I receive this error:

Problem parsing indexes.conf: There are multiple conflicting stanzas that refer to index 'summary' in indexes.conf.  Index names are case-insensitive.
Validating databases (splunkd validatedb) failed with code '1'.  If you cannot resolve the issue(s) above after consulting documentation, please file a case online at http://www.splunk.com/page/submit_issue

Is this not possible to do? It appears that it is conflicting with a summary index definition placed in $SPLUNK_HOME/etc/system/default/indexes.conf. I can override it there, but it obviously won't stay changed.

[jtrucks]

Change it in:

$SPLUNK_HOME/etc/system/local/indexes.conf

Because you are trying to change a system level setting that is in $SPLUNK_HOME/etc/system/default/indexes.conf, you must use the ../local/indexes.conf file to override those settings without losing them on patching and upgrades.