Deployment Architecture

How to move indexed data from default directory to custom directory?


Hello All,

I want to move my indexed data from the default directory i.e. /opt/splunk/var/lib/splunk to a different folder preferrable to the hot/warm volume. Is there any way this can be achieved with minimum down time.

Thanks in advance


Labels (1)
0 Karma


Hi @bbiswabhusan,

it's a usual practice to configure a dedicated path, usually a link to an additional storage for production indexes.

You can also mount different file systems: very performant for Hot and Warm data and less performane (and less expensive) for Cold data.

If you want to move all the data in a folder, you can simply change the value of $SPLUNK_DB variable in the $SPLUNK_Home/etc/splunk-launch.conf file.

If instead you want different locations for hot/Warm and Cold data, you could set-up the $SPLUNK_DB variable and configure different folders for the variables:

  • homePath (e.g.: /data/db)
  • coldPath (e.g.: /data/colddb)

in all the stanzas of indexes.conf.



0 Karma



if you have single indexer then just follow this one.

If you have a lot of data, then you could use rsync for move. You could do preparation steps with rsync even when splunkd is running. For final sync you must shutdown splunk and then use rsync with delete removed option to sync live and already transferred version. Then just update those indexes.conf etc. to point correct place and start splunk.

If you have indexer cluster this is working basically same way. You just need to stop whole indexer cluster before final sync and also update indexes.conf with manager node. Probably you need to do some hack with those indexes.conf when cluster starts and it haven't gotten a new indexes.conf on place? Just add local indexes.conf for those moved indexes and/or disable receiving until you have apply cluster bundle. But this is something which you must check and plan based on your situation. Of course you could ask support from local Splunk Partner or Professional Services to do it.

r. Ismo

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...