I have an Index,
home path= /data/splunk/indexes/home/index_name/db cold path = /data/splunk/indexes/cold/index_name/db thawed path= $Splunk_DB/index_name/ $Splunk_DB=/opt/splunk/var/lib/splunk
I have to move this index to new indexer cluster. Usually in the documentation it is given to move data in Splunk_DB to new location when you want to move indexes. But my data locations are different (not in Splunk_DB). May I know more about what is the procedure? Moreover I see .dat files in $SPLUNK_DB. what is the significance of those files?
Description from other duplicate question:
How to move index to new cluster where data is in one location(/data/splunk/indexes/.../index_name/db) and .dat files and thawed path in other location(/opt/splunk/var/lib/splunk).
in https://docs.splunk.com/Documentation/Splunk/6.5.1/Indexer/Moveanindex is described how to move an index from a location to another.
You said that you want to move an index from a non clustered indexer to a cluster, did I correctly undestand?
remember that an indexer cluster replies only the new events, so if you have old events in your index you cannot copy index files in the new location (they aren't replied)!
I had a similar problem and I solved in this way:
How are you planning to store the data in new cluster, will the homePath/coldPath and thawedPath will be different there as well? Actually in either case,you move data from old homePath/coldPath to new cluster's homePath/coldPath and data from old thawedPath to new cluster's thawedPath.
just give me a response if i understand something wrong.
Your main problem is that you need to change the "Splunk_DB" variable am i right?
To change the "Splunk_DB" variable just du this.
Unset the Splunk_DB variable by "unset SPLUNK_DB"
Then go to "$SPLUNK_HOME/etc/splunk_launch.conf" and change the "SPLUNK_DB" variable to the path of your choice.
I think there should be no problem by migrating your indexes as described in Docs. The described way in Docs should work for this scenario.
For the .dat files im not 100% sure but i think they hold the next bucket_id for the index.