Deployment Architecture

How to move indexed data from default directory to custom directory?

bbiswabhusan
Explorer

Hello All,

I want to move my indexed data from the default directory i.e. /opt/splunk/var/lib/splunk to a different folder preferrable to the hot/warm volume. Is there any way this can be achieved with minimum down time.

Thanks in advance

 

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @bbiswabhusan,

it's a usual practice to configure a dedicated path, usually a link to an additional storage for production indexes.

You can also mount different file systems: very performant for Hot and Warm data and less performane (and less expensive) for Cold data.

If you want to move all the data in a folder, you can simply change the value of $SPLUNK_DB variable in the $SPLUNK_Home/etc/splunk-launch.conf file.

If instead you want different locations for hot/Warm and Cold data, you could set-up the $SPLUNK_DB variable and configure different folders for the variables:

  • homePath (e.g.: /data/db)
  • coldPath (e.g.: /data/colddb)

in all the stanzas of indexes.conf.

Ciao.

Giuseppe

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

if you have single indexer then just follow this one.

https://docs.splunk.com/Documentation/Splunk/latest/Indexer/Moveanindex

If you have a lot of data, then you could use rsync for move. You could do preparation steps with rsync even when splunkd is running. For final sync you must shutdown splunk and then use rsync with delete removed option to sync live and already transferred version. Then just update those indexes.conf etc. to point correct place and start splunk.

If you have indexer cluster this is working basically same way. You just need to stop whole indexer cluster before final sync and also update indexes.conf with manager node. Probably you need to do some hack with those indexes.conf when cluster starts and it haven't gotten a new indexes.conf on place? Just add local indexes.conf for those moved indexes and/or disable receiving until you have apply cluster bundle. But this is something which you must check and plan based on your situation. Of course you could ask support from local Splunk Partner or Professional Services to do it.

r. Ismo

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...

SplunkTrust | 2024 SplunkTrust Application Period is Open!

It's that time again, folks! That's right, the application/nomination period for the 2024 SplunkTrust is ...