How do I move all log data to another filesystem?

[tcp97b]

Currently Splunk is installed in /opt/splunk, the data is in /opt/splunk/var/lib/splunk as it defaults to. I have a 280G partition that I would like to move the current data and have all future data get logged to. What is the best way to make this move?

[dwaddle]

Copy the data using OS utilities WHILE SPLUNK IS DOWN. Easiest way is probably using tar similar to as follows:

/opt/splunk/bin/splunk stop
cd /opt/splunk/var/lib
mv splunk splunk.save
mkdir splunk
mount /dev/sdxxxx /opt/splunk/var/lib/splunk
( cd splunk.save ; tar cf - . ) | ( cd splunk ; tar xvf - . )

Yes, that is two tar's piped into each other - very easy way of copying whilst getting permissions and symlinks right...

[gfriedmann]

I prefer
cp -a
as an easier way of copying with permissions and symlinks.