Splunk Search

How To move the okta index

mcclaugherty
New Member

I am trying to move the index for the okta app to a different location than what it installed as. When i do this splunk will not start. the setting for the app index seems also to be coming from the indexes.conf in the default folder of the app. any suggestions to move the index location would be greatly appreciated.

Tags (1)
0 Karma

mcclaugherty
New Member

this app is not getting all of its settings from 1 indexes.conf file. I ended putitng the specific directories in the default indexes.comf and the size settings in the app/local indexes.conf it should not work this but it is.

0 Karma

lguinn2
Legend
  • In the local folder for the app, create a new indexes.conf.

  • In the new indexes.conf, set the following attributes for the index (look at the indexes.conf in the default folder to be sure of the names)

    [the_index_name]
    homePath = whereyouwanttheindex/db
    coldPath = whereyouwanttheindex/colddb
    thawedPath = whereyouwanttheindex/thaweddb

Make sure that you specify an absolute path for each of the three attributes.

  • Stop Splunk

  • Copy the contents of the index directory from its current location to the new location. Use cp -rp on Unix - you must copy recursively and preserve permissions.

  • Start Splunk and make sure that the index is okay and using the new location.

  • Remove the old directories.

In the documentation: Move the index database

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...