https://community.splunk.com/t5/Knowledge-Management/Migrating-Splunk-data-from-NFS-to-Block-storage/m-p/92828#M7343 <P>The only comment I'll make here is that if you rsync a bucket in its hot state (a directory name like hot_v1_15) and then later rsync again, but this time the bucket has been moved to warm (a name like db_1381409248_1381408249_15), Splunk will refuse to start because of the collision between the bucket IDs (the _15 at the end).</P> <P>After your first rsync, but before your cutover, remove any hot buckets from the target system.</P> Thu, 10 Oct 2013 16:50:15 GMT sowings 2013-10-10T16:50:15Z https://community.splunk.com/t5/Knowledge-Management/Migrating-Splunk-data-from-NFS-to-Block-storage/m-p/92826#M7341 <P>What is the process from migrating Splunk data from NFS based storage to Block based storage?</P> Thu, 10 Oct 2013 14:50:56 GMT https://community.splunk.com/t5/Knowledge-Management/Migrating-Splunk-data-from-NFS-to-Block-storage/m-p/92826#M7341 brad63 2013-10-10T14:50:56Z https://community.splunk.com/t5/Knowledge-Management/Migrating-Splunk-data-from-NFS-to-Block-storage/m-p/92827#M7342 <P>There's nothing really special about NFS when storing the data there (other than performance issues). I'd just use "rsync -avot" to copy over the data. That way you can run it prior to your cutover time to get it close. Then shutdown, rsync a final time, change your configs, and start. When I'd done similar, though on SAN my multi-TB switchover only took about 15min of downtime.</P> Thu, 10 Oct 2013 16:08:15 GMT https://community.splunk.com/t5/Knowledge-Management/Migrating-Splunk-data-from-NFS-to-Block-storage/m-p/92827#M7342 mikelanghorst 2013-10-10T16:08:15Z https://community.splunk.com/t5/Knowledge-Management/Migrating-Splunk-data-from-NFS-to-Block-storage/m-p/92828#M7343 <P>The only comment I'll make here is that if you rsync a bucket in its hot state (a directory name like hot_v1_15) and then later rsync again, but this time the bucket has been moved to warm (a name like db_1381409248_1381408249_15), Splunk will refuse to start because of the collision between the bucket IDs (the _15 at the end).</P> <P>After your first rsync, but before your cutover, remove any hot buckets from the target system.</P> Thu, 10 Oct 2013 16:50:15 GMT https://community.splunk.com/t5/Knowledge-Management/Migrating-Splunk-data-from-NFS-to-Block-storage/m-p/92828#M7343 sowings 2013-10-10T16:50:15Z