We have two indexers and a single search head:
Splunk1
Splunk2
Splunkweb
Both Splunk1 and Splunk2 have their own independant SAN drives for Hot and Warm storage. For Cold storage, Splunk1 and Splunk2 share a NAS drive with enough space for extended retention.
Can I have Splunk1 and Splunk2 write to the same "Cold" directory for each index? Or should they be different directories for each indexer?
For example - Same Index:
Splunk1 and Splunk2: $SPLUNK_HOME/etc/system/local/indexes.conf
coldPath = /n01/data/spl/internetdb/colddb
coldPath = /n01/data/spl/databasedb/colddb
OR - Different Path:
Splunk1: $SPLUNK_HOME/etc/system/local/indexes.conf
coldPath = /n01/data/spl/internetdb1/colddb
coldPath = /n01/data/spl/databasedb1/colddb
Splunk2: $SPLUNK_HOME/etc/system/local/indexes.conf
coldPath = /n01/data/spl/internetdb2/colddb
coldPath = /n01/data/spl/databasedb2/colddb
Thanks
No they have to use different folders for homePath and coldPath.
This is because :
No they have to use different folders for homePath and coldPath.
This is because :
thank you for the addendum mister Sowings.
They could use different paths to the same storage partition. The issues Yann describe would arise if both indexers were attempting to use the same target directory as the location for their cold buckets.