Spreading out your Splunk index
You can spread out your Splunk index data across multiple disks and partitions. It is recommended that the manner in which you approach this should be based on a well thought out strategy and not merely on availability of storage.
In Splunk, paths (the locations) are set on an index-by-index basis, using the previously mentioned path attributes (homePath, coldPath, and thawedPath) in the indexes.conf file. Your fastest storage should be used for home data and progressively slower (and cheaper) storage for cold data.
Get Mastering Splunk now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
