Deployment Architecture

How to change the SPLUNK_DB path on first run for 7.0.1

jstockt
New Member

I need to change the location of all DB on first run, as the /opt/splunk doesn't have space to support the data.
When I try to put a fresh 7.0.1 extract down for a new install and then before the first start
edit /opt/splunk/etc/splunk-launch.conf

SPLUNK_DB=/home/build/build-home/splunk-home/var/lib/splunk

SPLUNK_DB=/san1/splunk_db

It creates the directory structure on first run but brings everything performance wise down to the point that the CLI and web page is unresponsive. Result is an install that is not functional.
I have also tried (to see if the directory is the issue to use /opt/splunk/splunk_db) and had the same issues
If I omit that step and let it create the default path under /opt/splunk/var/lib/splunk it works fine and has no performance issues.

It seems that changing this variable, before first launch, to set the location for ALL DB is no longer correct?

0 Karma

davpx
Communicator

How fast is your SAN? From the looks of it here you are mounting an external filesystem for your hot and warm buckets. If you cant do 1200 IOPS on that device, I'd advise not using it.

0 Karma

jstockt
New Member

This is only on the DEV box to get a fresh 7.x install. Production runs on 6.6.x with dedicated external SAN.
The mount point is just another directory that VMWare presents of the same presented disk. So /san1 or /opt/splunk are no different but made that way to simulate prod visually.
The issue seems to be 7.0.1 not liking me changing that SPLUNK_DB variable. If I do a fresh 6.6.3 it has no issues with it, Fresh 7.0.1 breaks.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...