I have an Index,
home path= /data/splunk/indexes/home/index_name/db cold path = /data/splunk/indexes/cold/index_name/db thawed path= $Splunk_DB/index_name/ $Splunk_DB=/opt/splunk/var/lib/splunk
I have to move this index to new indexer cluster. Usually in the documentation it is given to move data in SplunkDB to new location when you want to move indexes. But my data locations are different (not in SplunkDB). May I know more about what is the procedure? Moreover I see .dat files in $SPLUNK_DB. what is the significance of those files?
Description from other duplicate question:
How to move index to new cluster where data is in one location(/data/splunk/indexes/.../index_name/db) and .dat files and thawed path in other location(/opt/splunk/var/lib/splunk).
just give me a response if i understand something wrong.
Your main problem is that you need to change the "Splunk_DB" variable am i right?
To change the "Splunk_DB" variable just du this.
Unset the SplunkDB variable by "unset SPLUNKDB"
Then go to "$SPLUNKHOME/etc/splunklaunch.conf" and change the "SPLUNK_DB" variable to the path of your choice.
I think there should be no problem by migrating your indexes as described in Docs. The described way in Docs should work for this scenario.
For the .dat files im not 100% sure but i think they hold the next bucket_id for the index.
How are you planning to store the data in new cluster, will the homePath/coldPath and thawedPath will be different there as well? Actually in either case,you move data from old homePath/coldPath to new cluster's homePath/coldPath and data from old thawedPath to new cluster's thawedPath.
ok got it. what I should do with the .dat files present in $SPLUNKDB directory. should I move them as well to the SPLUNKDB directory in new server
How you solved this. We are having similar schenario, need to move the indexed data to new environment.
in https://docs.splunk.com/Documentation/Splunk/6.5.1/Indexer/Moveanindex is described how to move an index from a location to another.
You said that you want to move an index from a non clustered indexer to a cluster, did I correctly undestand?
remember that an indexer cluster replies only the new events, so if you have old events in your index you cannot copy index files in the new location (they aren't replied)!
I had a similar problem and I solved in this way: