I did like this in path: $SPLUNK_HOME/etc/system/default/indexes.conf for an Index (wallix) [wallix] repFactor = auto homePath = volume:hotwarm/wallix/db coldPath = volume:cold/wallix/colddb thawedPath = $SPLUNK_DB/wallix/thaweddb tstatsHomePath = volume:hotwarm/wallix/datamodel_summary homePath.maxDataSizeMB = 5120 coldPath.maxDataSizeMB = 10240 maxHotBuckets = 10 maxDataSize = auto_high_volume maxTotalDataSizeMB = 15360 maxWarmDBCount = 4294967295 frozenTimePeriodInSecs = 31104000
... View more