topic Re: moving indexes and .dat files in Getting Data In

moving indexes and .dat files

brdr — Fri, 14 Oct 2016 14:01:24 GMT

We using Splunk Enterprise, 5.2.2 on Linux. We are moving the indexes to different storage devices depending on the buckets (hot/warm, cold, etc..). We will the volume stanza in the indexes.conf to manage this. Question, what is the .dat files used for found in /opt/splunk/var/lib/splunk for each of the indexes? And, do you I need to move them to the hot/warm db location - how do I manage these going forward after indexes have been appropriately moved?

Thx

Re: moving indexes and .dat files

gcusello — Tue, 29 Sep 2020 11:25:47 GMT

Indexes configuration is in indexes.conf, that you can find in your app or in $SPLUNK_HOME/etc/system/local.

You can know where is your indexes.conf using web interface [Settings -- Indexes] at the App column:
- if there is system, you can find in $SPLUNK_HOME/etc/system/local;
- if there's an app, you can find in $SPLUNK_HOME/etc/apps/yourapp/local,
- sometimes it's in launcher app.

To move an index you have to do:
- stop Splunk,
- move the full directory of your index to the new path,
- modify indexes.conf with the new path,
- restart Splunk.

in indexes.conf you probably have $SPLUNK_DB/yourindex, you have to modify $SPLUNK_DB in the new path of your index.

Bye.
Giuseppe

Re: moving indexes and .dat files

brdr — Fri, 14 Oct 2016 16:32:40 GMT

Thank you the response. but my question wasn't around indexes, rather what is the .dat files for and what to do, if anything, once the indexes have been moved appropriately.

Re: moving indexes and .dat files

lycollicott — Fri, 14 Oct 2016 17:16:06 GMT

Are you talking about splunk-autogen-params.dat? It is sort of scratch space where splunkd writes information about how it is managing the buck. (I'm not sure what that information means though.)

You need to move the entire bucket folders, including splunk-autogen-params.dat. Everything in the bucket folder has to move together.

Re: moving indexes and .dat files

baldwintm — Wed, 01 Mar 2017 19:48:29 GMT

This question was answered in https://answers.splunk.com/answers/442499/why-are-we-seeing-dat-files-created-in-the-cold-to.html

"These .dat files hold the next bucket ID to be created for that index, and they aren't influenced by homePath etc. settings in indexes.conf."