After long discussion with the support, here is a workaround that work for us : In the $SPLUNK_HOME/etc/apps/splunk_ta_o365/local/props.conf  [o365:graph:api] TIME_PREFIX = ("createdDateTime":\s*")|timestamp TIMESTAMP_FIELDS = TIME_FORMAT = %Y-%m-%dT%H:%M:%S KV_MODE = json TZ = UTC   Hope it can help someone ! ... View more

Hi @AntoineDRN, you have to set the $SPLUNK_DB variable on Indexers in $SPLUNK_HOME/etc/splunk-launch.conf: you should find it commented, you have to uncomment it and use the correct folder where indexes are located, by default it's $SPLUNK_HOME/var/lib/splunk, in your case it should be /dev/vda1. Then, you have to insert in each path that you find in each indexes,conf [index_name] coldPath = $SPLUNK_DB\index_name\colddb homePath = $SPLUNK_DB\index_name\db thawedPath = $SPLUNK_DB\index_name\thaweddb Remember to restart Splunk after conf files upgrade. In this way the indexes.conf files address the correct folders. Ciao. Giuseppe ... View more