We are needing to do the exact same thing.  Anyone ever find a solution?   ... View more

It has to be an actual index definition.  And splunk will create the directory structure on the HF but will not write any data there. indexes.conf: [storage] homePath = $SPLUNK_DB/storage/db coldPath = $SPLUNK_DB/storage/colddb thawedPath = $SPLUNK_DB/storage/thaweddb maxDataSize = auto And the empty directories it creates: $ du -h storage 0 storage/db/GlobalMetaData 8.0K storage/db 0 storage/colddb 0 storage/thaweddb 0 storage/datamodel_summary 8.0K storage ... View more

Hello @Roy_9  Installing this TA now and ran into the same issue.  I had to create an indexes.conf on the HF for the TA to be able to verify the index exists.  As long as your outputs.conf for the HF has outputs.conf configured correctly, it will not write to the local index. Outputs.conf: [indexAndForward] index = false I just created TA_EMC-Isilon/local/indexes.conf to keep it with the app.  ... View more