topic Re: How to move .dat files after moving indexes to another volume? in Installation

How to move .dat files after moving indexes to another volume?

dipereira — Tue, 29 Sep 2020 14:44:28 GMT

Hello,

I have moved our $SPLUNK_DB folder to a SSD disk to improve performance.

But I realized that .dat files are still writing in my old $SPLUNK_DB folder ($SPLUNK_HOME/var/lib/splunk) and the index folder has been updated correctly in my new SSD volume.

What files could I delete in my old folder and how I set a configuration to splunk starts writing .dat files in the new $SPLUNK_DB folder?

Obs: I have followed Splunk documentation "How to move splunk index".

Re: How to move .dat files after moving indexes to another volume?

sbbadri — Fri, 30 Jun 2017 20:03:48 GMT

Did you change the $SPLUNK_DB folder old path to new path under indexes.conf. This will avoid splunk under default location.

Please go through below link for further clarification,

https://answers.splunk.com/answers/149248/how-to-move-index-from-one-hard-drive-to-another-in-splunk-clustered-environment.html

Re: How to move .dat files after moving indexes to another volume?

dipereira — Tue, 29 Sep 2020 14:44:32 GMT

Hi, thanks for the fast reply! =]

I did this:

Stopped Splunk

moved the old $SPLUNK_DB($SPLUNK_HOME/var/lib/splunk) to the new one /splunkdb: cp -rp $SPLUNK_DB/* /splunkdb

Created $SPLUNK_DB variable: export SPLUNK_DB=/splunkdb

Changed the SPLUNK_DB=/splunkdb in splunk-launch.conf.

Started Splunk

After that I saw .dat been populated in old folder.

I didn't change any configuration in indexes.conf, do I need to do something there?

Re: How to move .dat files after moving indexes to another volume?

dipereira — Wed, 05 Jul 2017 17:14:11 GMT

Anyone could help me understand why .dat files has been populated in /opt/splunk/var/lib/splunk instead of the new storage set in splunk-launch.conf at SPLUNK_DB attribute?

Re: How to move .dat files after moving indexes to another volume?

kmjefferson42 — Thu, 21 Jun 2018 19:04:54 GMT

I am curious to know also! I have moved my SPLUNK_DB to a separate drive but the .dat files are still being created/updated to the default location.

Re: How to move .dat files after moving indexes to another volume?

rteja9 — Wed, 06 May 2020 22:26:55 GMT

Hi dipereira, I am having the same issue. I still see dat files getting generated at default locaton even after I moved DPLUNk_DB path. Did you find any solution?