I have the same question, but your solution (using an app) does not solve it.
My problem is that I'm using a volumes configuration for all my indexes, using an app pushed to all my indexers. (The app is called "myindexers".)
However, the local indexes (e.g. _audit, _internal, etc.) are residing on the same disk as my custom indexes:
$ mount
/dev/mapper/db_dg-opt on /opt/splunk/var/lib/splunk type ext3 (rw)
Since the internal indexes don't use the volumes config, the disk will fill. I've been advised by people on the IRC channel to fix this by putting some overrides in system/local that force the internal indexes to use the volumes config instead of $SPLUNK_DB. That seems workable, but I'd rather do it with the deployment server if possible, rather than hand maintaining that file on my five different indexers.
So, in that situation, is the recommendation still to manually maintain system/local/indexes.conf?
Also, since this might be of benefit (truncated to just relevant parts):
$ /opt/splunk/bin/splunk cmd btool indexes list
[_internal]
coldPath = $SPLUNK_DB/_internaldb/colddb
homePath = $SPLUNK_DB/_internaldb/db
thawedPath = $SPLUNK_DB/_internaldb/thaweddb
[dev]
coldPath = volume:remote/dev/colddb
homePath = volume:local/dev/db
thawedPath = /opt/splunk/var/lib/splunk/dev/thaweddb
[volume:local]
maxVolumeDataSizeMB = 745942
path = /opt/splunk/var/lib/splunk
[volume:remote]
maxVolumeDataSizeMB = 3774873
path = /splunk_cold
... View more