Deployment Architecture

How do I move all log data to another filesystem?

tcp97b
New Member

Currently Splunk is installed in /opt/splunk, the data is in /opt/splunk/var/lib/splunk as it defaults to. I have a 280G partition that I would like to move the current data and have all future data get logged to. What is the best way to make this move?

Tags (2)
0 Karma

dwaddle
SplunkTrust
SplunkTrust

Copy the data using OS utilities WHILE SPLUNK IS DOWN. Easiest way is probably using tar similar to as follows:

/opt/splunk/bin/splunk stop
cd /opt/splunk/var/lib
mv splunk splunk.save
mkdir splunk
mount /dev/sdxxxx /opt/splunk/var/lib/splunk
( cd splunk.save ; tar cf - . ) | ( cd splunk ; tar xvf - . )

Yes, that is two tar's piped into each other - very easy way of copying whilst getting permissions and symlinks right...

gfriedmann
Communicator

I prefer
cp -a
as an easier way of copying with permissions and symlinks.

0 Karma
Get Updates on the Splunk Community!

Detector Best Practices: Static Thresholds

Introduction In observability monitoring, static thresholds are used to monitor fixed, known values within ...

Expert Tips from Splunk Education, Observability in Action, Plus More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Changes to Splunk Instructor-Led Training Completion Criteria

We’re excited to share an update to our instructor-led training program that enhances the learning experience ...