Can I move the cold buckets to a separate disk?

[dkeck]

Hi,

I was thinking about moving the cold buckets to a separate disk.

I found some questions and docs about it but not especially for Index Cluster.

So please help me to understand the steps. Would something like this work?:

1. Put Master in maintenance mode ( is this necessary?)
2. For each peer at a time : take it down with ./splunk offline 2.1 Change coldPath in indexes.conf to new path 2.2 copy old cold data to new path 2.3 Start peer up again
3. Repeat for each peer
4. Start up Master again

Please provide additional steps, if needed.

Since the Master is down I can not provide the changes in indexes.conf via the bundle, so the configuration differs, is there a way around that?

Would be great if someone could answer this.

Thank you

Regards

David

[dkeck · Accepted solution]

Before this will be one of the many unanswered questions I will reply myself:

I did not find a "master plan" for it, but what I did is to age out the cold buckets to frozen. The frozen buckets are already on a different drive. So thats it.

-Close-

[woodcock]

The whole point of maintenance mode is exactly that indexes.conf MUST be non-synchronized. Being in this mode does not stop indexing from happening. The ones that you haven't yet changed willl still be getting new events and rolling buckets to the old volume while you are updating the Indexer that you are doing and vice-versa as you complete the modifications on each Indexer. Be sure to update the indexes.conf on the CM before you take it out of mauntenance mode or you will have a bug mess.

[dkeck]

Thank you but its still not clear to me,

would you recommend to follow this post? guilmxm does not mention maintenance mode:

https://answers.splunk.com/answers/149248/how-to-move-index-from-one-hard-drive-to-another-in-splunk...