Getting Data In

change the indexer location

splunker_123
Path Finder

Hi

I have installed splunk indexer on a linux machine under installation directory /opt and there are quite a few forwarders sending data to this indexer

Later on we decided to move the indexer to a NAS storage,so now I have to point the indexer to store the data in NAS storage not under /opt.The data indexeed so far are test data so I'm not worried about the data transfer,just I need to point the indexer to NAS storage so that new data will be stored over there
what are the changes I've to make please?

Tags (1)
0 Karma
1 Solution

Kate_Lawrence-G
Contributor

Hi,

You can just place a copy on the local directory and edit it with the settings you need.
The local copy will take precedence over the default copy once splunk is restart and apply your changes.

View solution in original post

Kate_Lawrence-G
Contributor

Hi,

You can just place a copy on the local directory and edit it with the settings you need.
The local copy will take precedence over the default copy once splunk is restart and apply your changes.

splunker_123
Path Finder

Thank you so much for your help

0 Karma

Kate_Lawrence-G
Contributor

Yes the same logic should apply to the deployment server indexes.

0 Karma

splunker_123
Path Finder

Wonderful ..Thank you...Regarding the apps in splunk,we have enabled monitoring so the indexes.conf file inside SplunkDeploymentMonitor apps has got the same precedence there as well? Can I make a copy of indexes.conf from /opt/splunk/etc/apps/SplunkDeploymentMonitor/default to local and change the path in both files make it identical because I've changed the main indexes file now but still summary_* indexers are pointing to old location?

0 Karma

Kate_Lawrence-G
Contributor

No problem, you can either:

  1. Make the local file immutable (chattr +i) this will prevent any accidental changes/deletions to the file as the immutable flag would have to be removed prior to changes.
  2. Keep both file identical (just be careful of changes - like adding summary indexes or new indexes)

splunker_123
Path Finder

Thanks again....OK If I take a copy of indexes.conf and edit the new path for indexer and put it under local directory it should work.My concern is ,in the longer run,if someone accidently deletes the indexes.conf file under local directory then still there will be indexes.conf under default directory so at that point of time data will be written to the old path again.Inorder to avoid this to happen can I edit the indexes.conf under default directory as well? or is there any other option you can think of?

Old path is -->/opt
new path is-->/apps -this is a NAS filer.

0 Karma

Kate_Lawrence-G
Contributor

Hi,

You need to change the directories in local/indexes.conf to point to where you want the hot/warm, cold and frozen data to reside and restart splunk.

yannK
Splunk Employee
Splunk Employee

yes, recreate the indexes.conf definition (just the paths) in the local folder.

example
[myindex]
homePath= ...
coldPath= ...
frozenPath = ....

0 Karma

splunker_123
Path Finder

Hi
I dont have indexes.conf under etc/local but I've in the below locations

Should I copy the indexes.conf under default dir and put it under local directory then change there? If so should the change the path under default as well?

etc/apps/SplunkDeploymentMonitor/default/indexes.conf
etc/apps/sample_app/default/indexes.conf
etc/apps/SplunkLightForwarder/default/indexes.conf
etc/system/default/indexes.conf

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...