How to Un-mount old frozen directory and re-mount new frozen directory?

[khaizercruz]

Hello,

Currently we have an NFS drive which is mounted on /opt/archive directory
Splunk indexer installation is in Red hat

We plan to change the remote storage IP address

Current entry in /etc/fstab
192.168.24.1:/opt      /opt/archive     nfs    vers=4,rw,intr,nosuid  0  0

1. Before un-mounting is it required to stop rolling of cold buckets to frozen? how to stop this roll?
2. After mounting the new remote drive for frozen buckets Is there a way to verify that frozen directory is receiving from cold

[isoutamo]

Hi

1. Best way to ensure that splunk is not writing that directory is stop splunk for that unmount + mount time.

2. In 1t phase try to write something as splunk user to that new mount point. Then after splunk is up and running check from internal logs that splunk could frozen bucket to this mount point.

r. Ismo

BTW: NFS => Not For Splunk. There are big possibility that using NFS will generate issues to your environment especially if you are using cluster and unless your NFS service is not enough stable.