topic Remove data after moving index location in Getting Data In

Remove data after moving index location

ejwade — Thu, 14 Nov 2019 18:20:06 GMT

I just moved my homePath and coldPath to a new location, and wanted to delete the data stored on Splunk's default index location ($SPLUNK_DB). I would leave it, but it's using the bulk of that partition. Can I simply delete these files, or will they fall off from the relocate?

Re: Remove data after moving index location

yannK — Thu, 14 Nov 2019 19:21:36 GMT

If you moved the indexes folders paths, splunk should only know and use the new location for the new data.
You should be able to remove the old folders safely.

BUT : remove the index folders only, but do not delete the kvstore or the other modinputs and persistent storage, those are not indexes, even if they are stored on the same folders.

PS : if you wanted to relocate all of $SPLUNK_HOME. the trick is to edit the etc/splunk-launch.conf to give it a new path.

PS : as the $SPLUNK_DB is a default, it may be used for many indexes (and apps), you can verify if you missed something after a restart (the missing folders will be recreated)

Re: Remove data after moving index location

ejwade — Thu, 14 Nov 2019 20:06:36 GMT

Thanks, @yannK. I was able to delete folders with no issues.