Copy the data using OS utilities WHILE SPLUNK IS DOWN. Easiest way is probably using tar similar to as follows:
/opt/splunk/bin/splunk stop
cd /opt/splunk/var/lib
mv splunk splunk.save
mkdir splunk
mount /dev/sdxxxx /opt/splunk/var/lib/splunk
( cd splunk.save ; tar cf - . ) | ( cd splunk ; tar xvf - . )
Yes, that is two tar's piped into each other - very easy way of copying whilst getting permissions and symlinks right...
I prefer
cp -a
as an easier way of copying with permissions and symlinks.