Which if your indexers are using a different partition for their storage, could be anywhere.    I found that I was missing the link too,    put note that I've put the link in at kvstore level rather than the mongo  ln -s /splunkdata/kvstore /opt/splunk/var/lib/splunk/kvstore   Where /splunkdata/ is my mounted data drive where all my indexes go. ... View more