Deployment Architecture

How do I move all log data to another filesystem?

New Member

Currently Splunk is installed in /opt/splunk, the data is in /opt/splunk/var/lib/splunk as it defaults to. I have a 280G partition that I would like to move the current data and have all future data get logged to. What is the best way to make this move?

Tags (2)
0 Karma


Copy the data using OS utilities WHILE SPLUNK IS DOWN. Easiest way is probably using tar similar to as follows:

/opt/splunk/bin/splunk stop
cd /opt/splunk/var/lib
mv splunk
mkdir splunk
mount /dev/sdxxxx /opt/splunk/var/lib/splunk
( cd ; tar cf - . ) | ( cd splunk ; tar xvf - . )

Yes, that is two tar's piped into each other - very easy way of copying whilst getting permissions and symlinks right...


I prefer
cp -a
as an easier way of copying with permissions and symlinks.

0 Karma