Deployment Architecture

How to change the SPLUNK_DB path on first run for 7.0.1

jstockt
New Member

I need to change the location of all DB on first run, as the /opt/splunk doesn't have space to support the data.
When I try to put a fresh 7.0.1 extract down for a new install and then before the first start
edit /opt/splunk/etc/splunk-launch.conf

SPLUNK_DB=/home/build/build-home/splunk-home/var/lib/splunk

SPLUNK_DB=/san1/splunk_db

It creates the directory structure on first run but brings everything performance wise down to the point that the CLI and web page is unresponsive. Result is an install that is not functional.
I have also tried (to see if the directory is the issue to use /opt/splunk/splunk_db) and had the same issues
If I omit that step and let it create the default path under /opt/splunk/var/lib/splunk it works fine and has no performance issues.

It seems that changing this variable, before first launch, to set the location for ALL DB is no longer correct?

0 Karma

davpx
Communicator

How fast is your SAN? From the looks of it here you are mounting an external filesystem for your hot and warm buckets. If you cant do 1200 IOPS on that device, I'd advise not using it.

0 Karma

jstockt
New Member

This is only on the DEV box to get a fresh 7.x install. Production runs on 6.6.x with dedicated external SAN.
The mount point is just another directory that VMWare presents of the same presented disk. So /san1 or /opt/splunk are no different but made that way to simulate prod visually.
The issue seems to be 7.0.1 not liking me changing that SPLUNK_DB variable. If I do a fresh 6.6.3 it has no issues with it, Fresh 7.0.1 breaks.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...