Setting different Locations for Home and Cold storage

[mookiie2005]

We are trying to set two separate locations to store hot/warm and cold indexes. We see the $splunk_db field value in the splunk-launch.conf file currently it is set to SPLUNK_DB=E:\Splunkdata\Indexes. So for a entry in indexes.conf could we do the following:

Current Setting:

[akamai]
coldPath=$SPLUNK_DB\akamai\colddb
homePath=$SPLUNK_DB\akamai\db
thawedPath=$SPLUNK_DB\akamai\thaweddb
frozenTimePeriodInSecs=7776000

What we hope to do:

[akamai]
coldPath=F:\Splunkdata\Indexes\akamai\colddb
homePath=E:\Splunkdata\Indexes\akamai\db
thawedPath=$SPLUNK_DB\akamai\thaweddb
frozenTimePeriodInSecs=7776000

we want to store the home path on dedicated storage on drive E and the cold on SAN storage drive F. Is the above possible?

Alternatively could we set something like the below up in splunk-launch.conf:

SPLUNK_DB=E:\Splunkdata\Indexes
SPLUNK_DB_01=F:\Splunkdata\Indexes

and in indexes.conf have the following:

[akamai]
coldPath=$SPLUNK_DB_01\akamai\colddb
homePath=$SPLUNK_DB\akamai\db
thawedPath=$SPLUNK_DB\akamai\thaweddb
frozenTimePeriodInSecs=7776000

Is either of these two methods possible? Is one recommended?

[aholzer]

yes that's what I meant. Currently your paths just show up as one long string with no way of telling where they are new sub-directories.

Example:
you have: thawedPath=$SPLUNK_DBakamaithaweddb
I'm guessing it should be: thawedPath=$SPLUNK_DB\/akamai\/thaweddb

[mookiie2005]

What do you mean "escape" the slashes like "/" or do you mean something else?

[martin_mueller]

In general, putting hot/warm and cold on two different storage volumes is possible and fairly common. You could say that's a main purpose of having warm and cold separated.

I'm not 100% certain whether Splunk will recognize custom additional variables or not, just give it a shot with a temporary testing index. If that works then you should use the variable to simplify changes.

[martin_mueller]

A fully qualified path will always work, you should test using a second variable though if you expect a large number of settings to be based on that. Otherwise you will have maintenance hell down the road.

[mookiie2005]

Yes but how do we do that? Can we just use the fully qualified path to the directory?

[aholzer]

You may want to edit your question and escape your slashes so that they appear in your post and make your configurations much more readable