Quantcast
Channel: Questions in topic: "distributed-search"
Viewing all articles
Browse latest Browse all 180

How to configure and distribute indexes.conf with server specific CIFS shares via deployment server?

$
0
0
What's the recommendation about setting up indexes.conf which will be distributed (via deployment server) and also supports server specific shares? Basically, today all buckets are being stored on a LUN and I need to split off the colddb onto a CIFS share. Here is the current config which all the Windows indexers have/receive: splunk-launch.conf SPLUNK_DB=E:\Splunk indexes.conf [default] frozenTimePeriodInSecs = 126144000 lastChanceIndex = default [volume:primary] path = $SPLUNK_DB maxVolumeDataSizeMB = 7500000 [main] homePath = volume:primary/defaultdb/db coldPath = volume:primary/defaultdb/colddb thawedPath = $SPLUNK_DB/defaultdb/thaweddb maxTotalDataSizeMB = 2000 After a bit of trial and error, I found out one cannot add additional variables to the splunk-launch.conf, but can use $COMPUTERNAME which Splunk will pull from the OS env variables. So this is now what I've been trying on one indexer: indexes.conf [default] frozenTimePeriodInSecs = 126144000 lastChanceIndex = default [volume:primary] path = $SPLUNK_DB maxVolumeDataSizeMB = 7500000 [volume:cold] path = \\cifsdata.FQDN\SplunkColdData\$COMPUTERNAME [main] homePath = volume:primary/defaultdb/db coldPath = volume:cold/defaultdb/colddb thawedPath = $SPLUNK_DB/defaultdb/thaweddb maxTotalDataSizeMB = 2000 It appears to work. Took a few hours to migrate the few TB of colddb over, but I've ran into some new errors/oddities with this migrated indexer since then. Additionally, the splunk diag command doesn't resolve the $computername so it complains about every path. Is there a better way to accomplish the same end goal?

Viewing all articles
Browse latest Browse all 180

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>