Currently in Splunk we have it set up in indexes.conf to explicitly request that "cartlog" (a specific index) go to its own db:
/opt/splunk/etc/apps/webintelligence/local/indexes.conf
[cartlog]
coldPath = $SPLUNK_DB/cartlog/colddb
homePath = $SPLUNK_DB/cartlog/db
thawedPath = $SPLUNK_DB/cartlog/thaweddb
However, we don't have it specified for quite a few things, and they are all going to defaultdb. My question is, is it possible to set up new dbs in indexes.conf and then MOVE only SOME of the indexes over to the new db?
For instance, say I have index1, index2, and index3 all being stored in defaultdb. What I really want is to create db1, db2, and db3, and then move their respective indexes over FROM defaultdb and continue to index to the correct directory/db.
So far I have read through http://answers.splunk.com/answers/65301/moving-the-index-database and the link provided therein (http://docs.splunk.com/Documentation/Splunk/6.1.3/Indexer/Configureindexstorage). Please let me know if this is possible or if more information for what I am trying to accomplish is needed.
... View more
