topic Unable to move index database to another drive in Windows Server 2019 in Getting Data In

Unable to move index database to another drive in Windows Server 2019

rahulkumarfgf — Thu, 23 Jan 2020 15:02:55 GMT

Hey Guys! I am very new to Splunk Enterprise and it's still in testing phase. I am trying to use this documentation https://docs.splunk.com/Documentation/Splunk/8.0.1/Indexer/MoveAnIndex to move my database to another drive. However, when trying "D:> cacls D:\new\path\for\index /T /E /G :F" command in Windows Server 2019 cmd, I get an error saying "The system cannot find the file specified". I am not sure why does it say that. I have created the new folder in D:\ drive and using the correct path. Any help would be much appreciated.

Thank You!

Re: Unable to move index database to another drive in Windows Server 2019

jhornsby_splunk — Thu, 23 Jan 2020 20:07:54 GMT

Hi @rahulkumarfgf,

Unfortunately I don't have a VM around to test, but I'm guessing that Microsoft finally removed cacls.exe from Windows Server as of 2019. Therefore you'll need to use the icacls.exe command instead. E.g.:
icacls D:\new\path\for\index /t /c /grant "<the user Splunk Enterprise runs as>:(OI)(CI)(F)"

Cheers,

- Jo.

Re: Unable to move index database to another drive in Windows Server 2019

rahulkumarfgf — Thu, 23 Jan 2020 22:02:24 GMT

Thanks! I did try "icacls" but got the same error. I gave permission to the user from "Properties" Section and as of now, I was able to copy the index database. I created a new index and that shows up in the new drive as well. Hopefully, it works. Will update if anything changes.