topic Re: Temporary relocating the dispatch folder. in Splunk Search

Temporary relocating the dispatch folder.

agodoy — Thu, 02 May 2013 17:47:30 GMT

I am trying to move a massive amount of events from the main index to a dedicated index for the sourcetype. I am trying to do this by running a search and ...|collect index=dedicated index sourcetype=abc.

However, it seems like since the dispatch folder is on my / partition I am running out of space. I would like to temporarily move the folder to the same partitions that hosts the indexes since I have plenty of storage.

Any ideas on how to tackle this one?

Thanks

Re: Temporary relocating the dispatch folder.

yannK — Fri, 03 May 2013 15:41:51 GMT

Why not emptying the dispatch folder instead,
Or run your searches over a smaller time range ?

Re: Temporary relocating the dispatch folder.

agodoy — Fri, 03 May 2013 19:35:32 GMT

The folder does not have much. I really would suck to do it 1 day at a time for the last 6 months.

Can I rename the main index and then creat another main index or would that mess with Splunk?

Re: Temporary relocating the dispatch folder.

yannK — Fri, 03 May 2013 19:41:02 GMT

As long as the index is defined in indexes.conf, you can move and rename it.
So yes.