Getting Data In

Configuring Cold To Frozen path if cold is on a C: drive and I want my frozen path to be on a newly created F: drive

dbatts
Explorer

I created a new F: drive for my archiving or Frozen path. Currently everything is configured to the default and filling up my C: drive. How do I configure my indexes.conf to have my coldtofrozenpath to be on the F: drive?

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi dbatts,
you can put indexes.conf in one app (custom or default) or in $SPLUNK_HOME/etc/system/local (but I don't like!).
I usually put each of them in the related App.
So You can insert in your indexes.conf a stanza like this:

[my_index]

homePath   = C:\splunk_data\my_index\db
coldPath   = F:\splunk_data\my_index\colddb
thawedPath = F:\splunk_data\my_index\thaweddb

don't use spaces in path.

For other information see https://docs.splunk.com/Documentation/Splunk/7.0.1/Admin/Indexesconf

Bye.
Giuseppe

P.S.:
I usually use Windows only for test, never for production environments!

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi dbatts,
you can put indexes.conf in one app (custom or default) or in $SPLUNK_HOME/etc/system/local (but I don't like!).
I usually put each of them in the related App.
So You can insert in your indexes.conf a stanza like this:

[my_index]

homePath   = C:\splunk_data\my_index\db
coldPath   = F:\splunk_data\my_index\colddb
thawedPath = F:\splunk_data\my_index\thaweddb

don't use spaces in path.

For other information see https://docs.splunk.com/Documentation/Splunk/7.0.1/Admin/Indexesconf

Bye.
Giuseppe

P.S.:
I usually use Windows only for test, never for production environments!

nickhills
Ultra Champion

In indexes.conf for your given index you should set:

coldToFrozenDir = f:\Splunk\data\yourindexName

You need to set this to a path (not just a drive letter) and you may want to specify your index name to help keep things tidy.
See: https://docs.splunk.com/Documentation/Splunk/7.0.1/Admin/Indexesconf#PER_INDEX_OPTIONS

If my comment helps, please give it a thumbs up!
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...