Deployment Architecture

How to Un-mount old frozen directory and re-mount new frozen directory?

khaizercruz
Loves-to-Learn Lots

Hello,

Currently we have an NFS drive which is mounted on /opt/archive directory
Splunk indexer installation is in Red hat

We plan to change the remote storage IP address

Current entry in /etc/fstab
192.168.24.1:/opt      /opt/archive     nfs    vers=4,rw,intr,nosuid  0  0

1. Before un-mounting is it required to stop rolling of cold buckets to frozen? how to stop this roll?
2. After mounting the new remote drive for frozen buckets Is there a way to verify that frozen directory is receiving from cold

Labels (1)
Tags (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

1. Best way to ensure that splunk is not writing that directory is stop splunk for that unmount + mount time.

2. In 1t phase try to write something as splunk user to that new mount point. Then after splunk is up and running check from internal logs that splunk could frozen bucket to this mount point.

r. Ismo

BTW: NFS => Not For Splunk. There are big possibility that using NFS will generate issues to your environment especially if you are using cluster and unless your NFS service is not enough stable.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform

 Are you ready to revolutionize your IT operations? As digital transformation accelerates, the demand for ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...

Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...

Financial services organizations face an impossible equation: maintain 99.9% uptime for mission-critical ...