We am trying to roll of the frozen data from three indexers to a NFS mount directory which contains three sub-directories with indexer names. Whenever I am trying to create new index and define the frozen path, need to manually define the coldToFrozenDir on each Indexers as they must be pointing to the sub-directories on the mounts instead of main directory.
Is there a an option within indexes.conf to get this automated so we can deploy using our DS?
IDX1: /abc/frozen/idx1
IDX2:/abc/frozen/idx2
IDX2:/abc/frozen/idx3
In indexes.conf, we have two options for rolling of frozen data, one is the coldToFrozenDir
which you use here and other is coldToFrozenScript
in which you define a script to move the buckets to be frozen. So, you can use that and your script can dynamically take the current host (which is the indexer where buckets are frozen) and create/add rolled bucket to respective directory in NFS.
https://docs.splunk.com/Documentation/Splunk/8.0.1/Admin/Indexesconf
A sample (for reference) script can be found here:
https://answers.splunk.com/answers/338594/does-anyone-have-a-working-example-of-coldtofrozen.html
Its not in the docs, but have you tried using $HOSTNAME
at the end of the path?
In indexes.conf, we have two options for rolling of frozen data, one is the coldToFrozenDir
which you use here and other is coldToFrozenScript
in which you define a script to move the buckets to be frozen. So, you can use that and your script can dynamically take the current host (which is the indexer where buckets are frozen) and create/add rolled bucket to respective directory in NFS.
https://docs.splunk.com/Documentation/Splunk/8.0.1/Admin/Indexesconf
A sample (for reference) script can be found here:
https://answers.splunk.com/answers/338594/does-anyone-have-a-working-example-of-coldtofrozen.html