Thanks for your answer. We have data in one drive only and that is filling up. However, there are plenty of spaces available in other drives of the machine. In terms of modifying the indexes.conf, have found the there are several of them available to change. We have 30-40 indexes available to change the configurations on coldPath, homePath and thawedPath in this file of /opt/splunk/etc/apps/search/local/indexes.conf. Is there anywhere can change these values globally? And for future creation of indexes will be selected by default this configuration as well. At this point we don't want to delete anything just to move the data to a new directory after 1 year for some indexes and 6 months for others.
Any advise on configuration details will be highly appreciated.
Cheers.
... View more