What's the recommendation about setting up indexes.conf which will be distributed (via deployment server) and also supports server specific shares? Basically, today all buckets are being stored on a LUN and I need to split off the colddb onto a CIFS share.
Here is the current config which all the Windows indexers have/receive:
splunk-launch.conf
SPLUNK_DB=E:\Splunk
indexes.conf
[default]
frozenTimePeriodInSecs = 126144000
lastChanceIndex = default
[volume:primary]
path = $SPLUNK_DB
maxVolumeDataSizeMB = 7500000
[main]
homePath = volume:primary/defaultdb/db
coldPath = volume:primary/defaultdb/colddb
thawedPath = $SPLUNK_DB/defaultdb/thaweddb
maxTotalDataSizeMB = 2000
After a bit of trial and error, I found out one cannot add additional variables to the splunk-launch.conf, but can use $COMPUTERNAME which Splunk will pull from the OS env variables. So this is now what I've been trying on one indexer:
indexes.conf
[default]
frozenTimePeriodInSecs = 126144000
lastChanceIndex = default
[volume:primary]
path = $SPLUNK_DB
maxVolumeDataSizeMB = 7500000
[volume:cold]
path = \\cifsdata.FQDN\SplunkColdData\$COMPUTERNAME
[main]
homePath = volume:primary/defaultdb/db
coldPath = volume:cold/defaultdb/colddb
thawedPath = $SPLUNK_DB/defaultdb/thaweddb
maxTotalDataSizeMB = 2000
It appears to work. Took a few hours to migrate the few TB of colddb over, but I've ran into some new errors/oddities with this migrated indexer since then. Additionally, the splunk diag command doesn't resolve the $computername so it complains about every path.
Is there a better way to accomplish the same end goal?
↧
How to configure and distribute indexes.conf with server specific CIFS shares via deployment server?
↧