topic Re: Need to move Splunk install dir in Installation

Need to move Splunk install dir

rhall2016 — Tue, 02 Jul 2019 13:20:45 GMT

Need to move /opt/splunk to /data/splunk due to disk space issues. What is the best way forward with the least downtime?

Re: Need to move Splunk install dir

gcusello — Tue, 02 Jul 2019 13:26:54 GMT

Hi rhall2016,
see at https://answers.splunk.com/answers/2338/move-splunk-install-from-one-directory-to-another.html .
You could also see at https://docs.splunk.com/Documentation/Splunk/7.3.0/Installation/MigrateaSplunkinstance .

Bye.
Giuseppe

Re: Need to move Splunk install dir

rhall2016 — Tue, 02 Jul 2019 13:55:59 GMT

I've read both of those. The details I need is do I leave just a copy of splunk-launch.conf in /opt/splunk/etc and can delete the rest once moved in order to free up the space needed? Is there anything else that is need in the old dir once I change $SPLUNK_HOME to the new dir?

Re: Need to move Splunk install dir

woodcock — Tue, 02 Jul 2019 14:11:23 GMT

The safest way is to:
Add the disk space.
Shut down splunk.
Physically move splunk.
Create a soft link from the old home to the new home (you have no idea how many things are expecting Splunk to be where it used to be).
Start splunk.

Re: Need to move Splunk install dir

gcusello — Wed, 30 Sep 2020 01:09:50 GMT

Hi rhall2016,
you have to:

add the needed disk space,
stop Splunk,
move all the splunk folder in the new location,
edit and change $SPLUNK_HOME and $SPLUNK_DB in /opt/splunk/server/etc/splunk-launch.conf,
check if in your apps there are some absolute paths in inputs.conf and eventually update them,
if you have the automatic start scripts, update them,
start Splunk.

You don't need to leave anything in Splunk old folder.

Bye.
Giuseppe

Re: Need to move Splunk install dir

rhall2016 — Tue, 02 Jul 2019 16:37:44 GMT

Tracking now. Thanks for the input.

Re: Need to move Splunk install dir

rhall2016 — Tue, 02 Jul 2019 16:42:52 GMT

I'm going to test this tonight and see what I get. sym-links slipped my mind.

Re: Need to move Splunk install dir

woodcock — Tue, 02 Jul 2019 17:32:36 GMT

It is super cheap insurance. People forget to check cron and logrotate and all of those other things that might be touching Splunk from the outside.