How to move indexed data from default directory to custom directory?

[bbiswabhusan]

Hello All,

I want to move my indexed data from the default directory i.e. /opt/splunk/var/lib/splunk to a different folder preferrable to the hot/warm volume. Is there any way this can be achieved with minimum down time.

Thanks in advance

[gcusello]

Hi @bbiswabhusan,

it's a usual practice to configure a dedicated path, usually a link to an additional storage for production indexes.

You can also mount different file systems: very performant for Hot and Warm data and less performane (and less expensive) for Cold data.

If you want to move all the data in a folder, you can simply change the value of $SPLUNK_DB variable in the $SPLUNK_Home/etc/splunk-launch.conf file.

If instead you want different locations for hot/Warm and Cold data, you could set-up the $SPLUNK_DB variable and configure different folders for the variables:

• homePath (e.g.: /data/db)
• coldPath (e.g.: /data/colddb)

in all the stanzas of indexes.conf.

Ciao.

Giuseppe

[isoutamo]

Hi

if you have single indexer then just follow this one.

https://docs.splunk.com/Documentation/Splunk/latest/Indexer/Moveanindex

If you have a lot of data, then you could use rsync for move. You could do preparation steps with rsync even when splunkd is running. For final sync you must shutdown splunk and then use rsync with delete removed option to sync live and already transferred version. Then just update those indexes.conf etc. to point correct place and start splunk.

If you have indexer cluster this is working basically same way. You just need to stop whole indexer cluster before final sync and also update indexes.conf with manager node. Probably you need to do some hack with those indexes.conf when cluster starts and it haven't gotten a new indexes.conf on place? Just add local indexes.conf for those moved indexes and/or disable receiving until you have apply cluster bundle. But this is something which you must check and plan based on your situation. Of course you could ask support from local Splunk Partner or Professional Services to do it.

r. Ismo