Deployment Architecture

How to move indexed data from default directory to custom directory?

bbiswabhusan
Explorer

Hello All,

I want to move my indexed data from the default directory i.e. /opt/splunk/var/lib/splunk to a different folder preferrable to the hot/warm volume. Is there any way this can be achieved with minimum down time.

Thanks in advance

 

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @bbiswabhusan,

it's a usual practice to configure a dedicated path, usually a link to an additional storage for production indexes.

You can also mount different file systems: very performant for Hot and Warm data and less performane (and less expensive) for Cold data.

If you want to move all the data in a folder, you can simply change the value of $SPLUNK_DB variable in the $SPLUNK_Home/etc/splunk-launch.conf file.

If instead you want different locations for hot/Warm and Cold data, you could set-up the $SPLUNK_DB variable and configure different folders for the variables:

  • homePath (e.g.: /data/db)
  • coldPath (e.g.: /data/colddb)

in all the stanzas of indexes.conf.

Ciao.

Giuseppe

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

if you have single indexer then just follow this one.

https://docs.splunk.com/Documentation/Splunk/latest/Indexer/Moveanindex

If you have a lot of data, then you could use rsync for move. You could do preparation steps with rsync even when splunkd is running. For final sync you must shutdown splunk and then use rsync with delete removed option to sync live and already transferred version. Then just update those indexes.conf etc. to point correct place and start splunk.

If you have indexer cluster this is working basically same way. You just need to stop whole indexer cluster before final sync and also update indexes.conf with manager node. Probably you need to do some hack with those indexes.conf when cluster starts and it haven't gotten a new indexes.conf on place? Just add local indexes.conf for those moved indexes and/or disable receiving until you have apply cluster bundle. But this is something which you must check and plan based on your situation. Of course you could ask support from local Splunk Partner or Professional Services to do it.

r. Ismo

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk Cloud Platform 9.1.2308?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2308! Analysts can ...

Index This | Why do they call it hyper text?

November 2023 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

State of Splunk Careers 2023: Career Resilience and the Continued Value of Splunk

For the past three years, Splunk has partnered with Enterprise Strategy Group to conduct a survey that gauges ...