Deployment Architecture

How to change the SPLUNK_DB path on first run for 7.0.1

New Member

I need to change the location of all DB on first run, as the /opt/splunk doesn't have space to support the data.
When I try to put a fresh 7.0.1 extract down for a new install and then before the first start
edit /opt/splunk/etc/splunk-launch.conf



It creates the directory structure on first run but brings everything performance wise down to the point that the CLI and web page is unresponsive. Result is an install that is not functional.
I have also tried (to see if the directory is the issue to use /opt/splunk/splunk_db) and had the same issues
If I omit that step and let it create the default path under /opt/splunk/var/lib/splunk it works fine and has no performance issues.

It seems that changing this variable, before first launch, to set the location for ALL DB is no longer correct?

0 Karma


How fast is your SAN? From the looks of it here you are mounting an external filesystem for your hot and warm buckets. If you cant do 1200 IOPS on that device, I'd advise not using it.

0 Karma

New Member

This is only on the DEV box to get a fresh 7.x install. Production runs on 6.6.x with dedicated external SAN.
The mount point is just another directory that VMWare presents of the same presented disk. So /san1 or /opt/splunk are no different but made that way to simulate prod visually.
The issue seems to be 7.0.1 not liking me changing that SPLUNK_DB variable. If I do a fresh 6.6.3 it has no issues with it, Fresh 7.0.1 breaks.

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...