topic Re: Migrating splunk folder to another LVM file system in Getting Data In

Migrating splunk folder to another LVM file system

chandu245 — Fri, 08 Mar 2019 07:35:42 GMT

I am in need of migrating the splunk folder(/opt/splunk/var/lib/splunk) to another LVM as the current file system is getting filled up. This folder has db and some other files.
Any suggestions or steps?

Found this but steps are not refined - https://answers.splunk.com/answers/3390/how-do-i-move-all-log-data-to-another-filesystem.html

Re: Migrating splunk folder to another LVM file system

nickhills — Fri, 08 Mar 2019 10:02:53 GMT

The answer from that other post is quite concise, and describes the steps to take if you're going to use a mount to present the new volume.

If you want to move the data to a different path:

Stop Splunk
Copy the contents of $SPLUNK_HOME/var/lib/splunk to your new location.
(You can use @dwaddle's suggested approach of using tar, or cp/rsync or anything else which robustly copies the data, but pay attention to permissions)
Update the path in your indexes.conf to reflect the new data locations.
Start Splunk

Re: Migrating splunk folder to another LVM file system

chandu245 — Fri, 08 Mar 2019 10:10:06 GMT

@nickhillscpl Thanks! Will try this and update over here.

Re: Migrating splunk folder to another LVM file system

chandu245 — Wed, 30 Sep 2020 00:15:04 GMT

This is what I followed to get this migrated.

Stop the splunk : service splunk stop
Run the below command : rsync -av /opt/splunk/var/lib/ /splunk_data_vol/
Take a backup of /opt/splunk/etc/splunk-launch.conf
Override the new $SPLUNK_DB path /splunk_data_vol/splunk under /opt/splunk/etc/splunk-launch.conf
Start the splunk : service splunk start