Hi Henry/Archie(?), first create a file as big as you think you will need for splunk data dd if=/dev/zero of=/mydata/splunkfs.img bs=1M count=5000 Then format it with ext4 (sans journal, which is kind of moot in this case): mkfs.ext4 -O ^has_journal /mydata/splunkfs.img Add a line to /etc/fstab like this: /mydata/splunkfs.img /opt/splunk/var/ auto loop 0 0 Stop splunk: /opt/splunk/bin/splunk stop Then just something like cd /opt/splunk mkdir vartmp mv var/* vartmp mount var mv vartmp/* var /opt/splunk/bin/splunk start ... View more

Since btrfs is planned to become the default in Fedora 17 and others will surely follow, I think splunk should start to support it as soon as possible. As a workaround I've loopback-mounted a file formatted with ext4 to /opt/splunk/var and copied the contents of the original directory there. Seems to work just fine so far. ... View more