Mastering Splunk

Configuring indexes

Splunk will allow you to set the location (path) to your nonclustered indexes using Splunk Web, but the majority of the configurations must be done by editing the indexes.conf file (for this discussion, we will stick to nonclustered indexes).

The indexes.conf file should be saved at $SPLUNK_HOME/etc/system/local/ or in a custom app directory, in $SPLUNK_HOME/etc/apps/.

The following are the most interesting index configuration attributes (you can use the product documentation to review the full list):

• homePath, coldPath, and thawedPath: These attributes are all required settings. These indicate where Splunk will place the index buckets (hot/warm are stored in home, cold in cold, and thawed in thawed). The ColdToFrozenDir attribute ...