Deployment Architecture

How to Un-mount old frozen directory and re-mount new frozen directory?

khaizercruz
Loves-to-Learn Lots

Hello,

Currently we have an NFS drive which is mounted on /opt/archive directory
Splunk indexer installation is in Red hat

We plan to change the remote storage IP address

Current entry in /etc/fstab
192.168.24.1:/opt      /opt/archive     nfs    vers=4,rw,intr,nosuid  0  0

1. Before un-mounting is it required to stop rolling of cold buckets to frozen? how to stop this roll?
2. After mounting the new remote drive for frozen buckets Is there a way to verify that frozen directory is receiving from cold

Labels (1)
Tags (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

1. Best way to ensure that splunk is not writing that directory is stop splunk for that unmount + mount time.

2. In 1t phase try to write something as splunk user to that new mount point. Then after splunk is up and running check from internal logs that splunk could frozen bucket to this mount point.

r. Ismo

BTW: NFS => Not For Splunk. There are big possibility that using NFS will generate issues to your environment especially if you are using cluster and unless your NFS service is not enough stable.

0 Karma
Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...