Getting Data In

How to change modinputs checkpoints location

MIJ75
Explorer

Hi,

We are looking to change the location of the modinputs checkpoints.
By default, the checkpoints are in $SPLUNK_HOME/var/lib/splunk/modinputs/
I did not find any parameter to change this.
Do you know if/how we can do this?

FYI, the needs comes from our citrix servers, they start on a golden image, but have their eventlogs in a persistent location (D drive). So each time the sever reboot, we loose the checkpoints and all the events in the eventlogs are forwarded, so we have duplicate events in splunk. We'd like to define the location of the checkpoints to the persistent location.

If not possible we'll have to use the current_only parameter in the input, but we'll lose some startup event and we'd like to avoid this.

Thanks
Michael

jconger
Splunk Employee
Splunk Employee

I haven't tested this, but a symbolic link may work. Link either the entire modinputs folder, or individual subfolders to a folder on your 😧 drive. This would require a change on your PVS or MCS golden image though.

MIJ75
Explorer

Yes, we thought about this option. Not tested yet. I'll check with the citrix admin.
But I would check if we can change this default path with a config file or something before doing this.

Thanks for your input.

0 Karma

MIJ75
Explorer

Just to let you know. We have tested the symbolic links and all is working as expected.
Thanks

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...