Splunk Search

How To move the okta index

mcclaugherty
New Member

I am trying to move the index for the okta app to a different location than what it installed as. When i do this splunk will not start. the setting for the app index seems also to be coming from the indexes.conf in the default folder of the app. any suggestions to move the index location would be greatly appreciated.

Tags (1)
0 Karma

mcclaugherty
New Member

this app is not getting all of its settings from 1 indexes.conf file. I ended putitng the specific directories in the default indexes.comf and the size settings in the app/local indexes.conf it should not work this but it is.

0 Karma

lguinn2
Legend
  • In the local folder for the app, create a new indexes.conf.

  • In the new indexes.conf, set the following attributes for the index (look at the indexes.conf in the default folder to be sure of the names)

    [the_index_name]
    homePath = whereyouwanttheindex/db
    coldPath = whereyouwanttheindex/colddb
    thawedPath = whereyouwanttheindex/thaweddb

Make sure that you specify an absolute path for each of the three attributes.

  • Stop Splunk

  • Copy the contents of the index directory from its current location to the new location. Use cp -rp on Unix - you must copy recursively and preserve permissions.

  • Start Splunk and make sure that the index is okay and using the new location.

  • Remove the old directories.

In the documentation: Move the index database

0 Karma
Get Updates on the Splunk Community!

Modern way of developing distributed application using OTel

Recently, I had the opportunity to work on a complex microservice using Spring boot and Quarkus to develop a ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had 3 releases of new security content via the Enterprise Security ...

Archived Metrics Now Available for APAC and EMEA realms

We’re excited to announce the launch of Archived Metrics in Splunk Infrastructure Monitoring for our customers ...