Synopsis
This is a splunk app contains all of the index definitions and their related settings/parameters.
Code Example
Index definitions:
# CUSTOMER INDEXES
[test]
homePath = volume:primary/test/db
coldPath = volume:primary/test/colddb
thawedPath = $SPLUNK_DB/test/thaweddb
maxTotalDataSizeMB = 50000
frozenTimePeriodInSecs = 2592000
[syslog]
homePath = volume:primary/syslog/db
coldPath = volume:primary/syslog/colddb
thawedPath = $SPLUNK_DB/syslog/thaweddb
Motivation
This app allows the splunk administrator to modify all index settings in one location instead of per-app.
Installation
This app should be placed in /opt/splunk/etc/apps - this assumes the contents of "spl_indexer_vol" has already been installed to define data volume locations. If this is not the case, modifications will need to be made to all homePath and coldPath locations to correspond to an existing data path on the system.