We have a clustered environment.
3 Indexers , 1 search head, 1 cluster master , 4 heavy forwarders and 100+ universal forwarders
The Infrastructure team wants to change the Hard Drives on the existing Splunk Infrastructure.
How can we move the indexer data/information from one hard drive to another without any data loss.
take a look at the docs http://docs.splunk.com/Documentation/Splunk/6.3.0/Indexer/Moveanindex about moving an index to a different file system / disk. As well take a look at this answer http://answers.splunk.com/answers/149248/how-to-move-index-from-one-hard-drive-to-another-in-splunk-... which covers the cluster index move.
Hope this helps ...
We will not be changing the actual physical servers.
In this case when we get a new HDD can we not just replicate the content on the drive and use the new Drive?
Not sure if it makes sense...