change the indexer location

[splunker_123]

Hi

I have installed splunk indexer on a linux machine under installation directory /opt and there are quite a few forwarders sending data to this indexer

Later on we decided to move the indexer to a NAS storage,so now I have to point the indexer to store the data in NAS storage not under /opt.The data indexeed so far are test data so I'm not worried about the data transfer,just I need to point the indexer to NAS storage so that new data will be stored over there
what are the changes I've to make please?

[Kate_Lawrence-G · Accepted solution]

Hi,

You can just place a copy on the local directory and edit it with the settings you need.
The local copy will take precedence over the default copy once splunk is restart and apply your changes.

[splunker_123]

Thank you so much for your help

[Kate_Lawrence-G]

Yes the same logic should apply to the deployment server indexes.

[splunker_123]

Wonderful ..Thank you...Regarding the apps in splunk,we have enabled monitoring so the indexes.conf file inside SplunkDeploymentMonitor apps has got the same precedence there as well? Can I make a copy of indexes.conf from /opt/splunk/etc/apps/SplunkDeploymentMonitor/default to local and change the path in both files make it identical because I've changed the main indexes file now but still summary_* indexers are pointing to old location?

[Kate_Lawrence-G]

No problem, you can either:

1. Make the local file immutable (chattr +i) this will prevent any accidental changes/deletions to the file as the immutable flag would have to be removed prior to changes.
2. Keep both file identical (just be careful of changes - like adding summary indexes or new indexes)

[splunker_123]

Thanks again....OK If I take a copy of indexes.conf and edit the new path for indexer and put it under local directory it should work.My concern is ,in the longer run,if someone accidently deletes the indexes.conf file under local directory then still there will be indexes.conf under default directory so at that point of time data will be written to the old path again.Inorder to avoid this to happen can I edit the indexes.conf under default directory as well? or is there any other option you can think of?

Old path is -->/opt
new path is-->/apps -this is a NAS filer.

[Kate_Lawrence-G]

Hi,

You need to change the directories in local/indexes.conf to point to where you want the hot/warm, cold and frozen data to reside and restart splunk.

[yannK]

yes, recreate the indexes.conf definition (just the paths) in the local folder.

example
[myindex]
homePath= ...
coldPath= ...
frozenPath = ....

[splunker_123]

Hi
I dont have indexes.conf under etc/local but I've in the below locations

Should I copy the indexes.conf under default dir and put it under local directory then change there? If so should the change the path under default as well?

etc/apps/SplunkDeploymentMonitor/default/indexes.conf
etc/apps/sample_app/default/indexes.conf
etc/apps/SplunkLightForwarder/default/indexes.conf
etc/system/default/indexes.conf