Colddb can be specified on any available filesystem the OS has access to.
Specify your colddb in
$SPLUNK_HOME/etc/system/local/indexes.conf so splunk can find it.
[ indexname ]
coldPath = < path to filesystem >
bucket directory db's will be created in
$SPLUNK_HOME/var/lib/splunk/index_name/colddb/db_n_n_n
NFS, SAN are perfectly fine for colddb bucket storage as colddb typically stores older, read only bucket data accessed by long running / time based searches.
Some other things you can do to set your index size:
Set your maxWarmDBCount to a smaller number, so more data is stored in cold as well
64bit systems - each warmDB bucket = 10gig
32bit systems - each warmDB bucket = 750mb
maxWarmDBCount = 30 (For example this would set your warm buckets to 30 dirs totaling 300 gigs on a 64 bit system)
After this number is reached, any new warm bucket db's created would roll the oldest warm db into your cold db directory.
Set your maxTotalDataSizeMB = < integer >
Set this value in MB, if the total index size reaches this number the oldest data is frozen(deleted by default)
Set your frozenTimePeriodInSecs = < integer >
Set the variable to the number of seconds after which indexed data should be erased.
Restart splunk and changes should take effect.
(Although it may take some time to move large amounts of data)
A similar issue on disk space reclaiming emergencies is splunk answers as well
http://answers.splunk.com/questions/1009/my-filesystem-is-full-and-splunk-stopped-indexing-how-do-i-make-space-start-splu
Official docs at
http://www.splunk.com/base/Documentation/latest/Admin/SetARetirementAndArchivingPolicy
... View more
