Migrate an index



Our current indexer is our of physical space. We mounted some storage and I'd like to move an index over to the new mount point.

Is there a procedure for this?

My plan was
1) Shutdown Splunk server
2) Copy index over
3) Edit the index.conf to point to the new locations
4) start splunk

Anything I'm missing?

Tags (3)
0 Karma

Splunk Employee
Splunk Employee

There is documentation for this in the Managing Indexes and Clusters manual, see Move the index database.


That's it. Just be sure to preserve the ownership and permissions for all the files, and be sure to copy all subdirectories.
In Linux, cp -rp should do it...

Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!