Getting Data In

Can we create a symbolic link for only search peer bundles in indexers?

divyavikas123
Explorer

Suppose splunk is installed in the path called SPLUNK_HOME/etc/.... and the search peers bundles are located the SPLUNK_HOME/var/run/searchpeers.But always it gets fill which leads to stopping the indexer to index the data.so I want to create a symbolic link for that searchpeers bundles to other location(or drive),the path is abc/splunk.So that I should not get the space full due to search peers bundles again.
1) the search heads are in clusters and indexers are not?
2)Is it possible to create the symlink only for searchpeers to the path abc/splunk without any consequences?
2)will there be any problem related to anything after creating a symlink to searchpeers?

0 Karma

valiquet
Contributor

As long at it is a local symlink it's fine.

You should think of blacklisting lookups from the bundle. It will help. If you do so, you'll need to use local=true when using lookups

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...

Updated Data Management and AWS GDI Inventory in Splunk Observability

We’re making some changes to Data Management and Infrastructure Inventory for AWS. The Data Management page, ...