I would just like to confirm my syntax... I've read a bunch of postings, I've RTFM, but none have an actual sample or example of what's needed in the int (that I've found).
I've stopped Splunk.
Moved the colddb from old location to new location.
Edited /opt/splunk/etc/system/local/indexes.conf
and added the following:
coldPath = /newspace/colddb
coldPath.maxDataSizeMB = 409600
And restarted Splunk.
That's it, in a nutshell, right? (assuming a 500 gig drive).
Please let me know if that 's wrong...
thanks!
Mike
Hi Mike,
in a nutshell it is as simple as this:
colddb
from $SPLUNK_DB//colddb
to /newspace/colddb
Edited /opt/splunk/etc/system/local/indexes.conf
and add the following for the index:
coldPath = /newspace/colddb
Restart Splunk
You can also verify your setting were applied by running this command from the CLI:
$SPLUNK_HOME/bin/splunk cmd btool splunk cmd btool --debug indexes list <index_name>
With this you can verify if your settings is not over-written by some other indexes.conf
, see the docs for more details on this http://docs.splunk.com/Documentation/Splunk/6.3.0/Admin/Wheretofindtheconfigurationfiles
Hope this helps...
cheers, MuS