Is it ok to mix volumes and paths in indexes.conf?

[jeski]

Hi, we have three clustered indexers and are looking to leverage slow disks for the cold paths. I'm wondering if it is acceptable to only have a volume configuration for this. Or must the home paths also be defined as a volume (Yes a noob). I'm considering something like this in the indexes.conf:

[volume:cold]
path = /path/to/slower/disk
# 5TB with some headroom leftover (data summaries, etc)
maxVolumeDataSizeMB = 4600000

And then reference the path to the cold volume:

[adf]
thawedPath = $SPLUNK_DB/adf/thaweddb
homePath = $SPLUNK_DB/adf/db
coldPath = $SPLUNK_DB/adf/colddb
coldPath   = volume:cold/adf/colddb

[xpac · Accepted solution]

Hey,

that's perfectly fine, if you remove the second last line, like this:

[volume:cold]
path = /path/to/slower/disk
# 5TB with some headroom leftover (data summaries, etc)
maxVolumeDataSizeMB = 4600000

[adf]
thawedPath = $SPLUNK_DB/adf/thaweddb
homePath = $SPLUNK_DB/adf/db
coldPath = volume:cold/adf/colddb

You're not required to either go all volumes or no volumes at all - you can mix it. 🙂

Hope that helps - if it does I'd be happy if you would upvote/accept this answer, so others could profit from it. 🙂

[jeski]

thank you!