Hi everyone. I am trying to move the location of the summary index from local disk to a SAN mount. I have written an app that includes an appname/default/indexes.conf file with the following (i have also tried placing in appname/local/indexes.conf):
[volume:HOT]
path=/splunk/hot
maxVolumeDataSizeMB=960000
[volume:COLD]
path=/splunk/cold
maxVolumeDataSizeMB=960000
[SUMMARY]
disabled=false
homePath=volume:HOT/summary
coldPath=volume:COLD/summary
thawedPath=/splunk/thawed/summary
maxDataSize=auto
However, when trying to start up splunk after this app has been deployed, I receive this error:
Problem parsing indexes.conf: There are multiple conflicting stanzas that refer to index 'summary' in indexes.conf. Index names are case-insensitive.
Validating databases (splunkd validatedb) failed with code '1'. If you cannot resolve the issue(s) above after consulting documentation, please file a case online at http://www.splunk.com/page/submit_issue
Is this not possible to do? It appears that it is conflicting with a summary index definition placed in $SPLUNK_HOME/etc/system/default/indexes.conf. I can override it there, but it obviously won't stay changed.
Change it in:
$SPLUNK_HOME/etc/system/local/indexes.conf
Because you are trying to change a system level setting that is in $SPLUNK_HOME/etc/system/default/indexes.conf
, you must use the ../local/indexes.conf
file to override those settings without losing them on patching and upgrades.