Splunk Enterprise

Is there any way to globally force all indexes to use a different location for their colddb?

msarro
Builder

Hi everyone. We have a number of devs working on a test server and are running into issues with space. It would be very helpful if we could somehow force ALL splunk index colddb's to use an external disk.

The only way I know of to do this is with an indexes.conf file. However the problem with that is you need to manually specify the path for the new colddb location. We have indexes constantly being created and removed for testing purposes, and modifying the indexes.conf file requires a restart.

A global command that would automatically say, "by default, all cold db's should be here" would be really helpful.

Tags (1)
0 Karma

sowings
Splunk Employee
Splunk Employee

1) You can use the REST API to create an index on the fly. See http://splunk-base.splunk.com/answers/96233/create-new-index-without-restarting-splunk-indexer.

2) The problem with a specific coldPath setting is that each index will have to have its own, and if they all inherit the same setting, they'll be writing to the same folder and will thereby generate bucket collisions.

3) Try a volume setting instead. By setting volume:cold, you can then reference a handy shorthand when you create the index.

4) Combine points 1 and 3, create a shell script to issue a curl command line REST call to create a new index, and automatically populate the coldPath setting including a volume:cold (and the name of the index as supplied on the command line) to give your developers the flexibility they need.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...