I want to keep all hot/warm buckets under /opt/Splunk_hot dir and cold to /opt/Splunk_cold dir.

[ansif]

I want to keep all hot/warm buckets under /opt/Splunk_hot dir and cold to /opt/Splunk_cold dir.

I have updated all addons indexes.conf file by following:

[volume:splunkdb_cold]
path=/opt/Splunk_cold

coldPath =volume:splunkdb_cold/$_index_name/colddb

I could see directories created under /opt/Splunk_cold but no files are written there.

Is there any option to check if this configuration is working fine by forcing an index to roll from warm to cold?

And currently the cold dbs are under /opt/Splunk_hot/$indexname/colddb Can I move these files to /opt/Splunk_cold using mv command?

[traxxasbreaker]

I'm curious as to whether those cold buckets still under the hot/warm path are actually searchable with that configuration, and I strongly suspect that they might not be. Can you please try running | dbinspect and see if it does show those cold buckets?

To answer your question about moving the buckets, it's probably better to move the existing cold data rather than just waiting for new data to roll to cold so all the cold buckets will be in the right place, but the fact that it created the directory structures when you applied that configuration is a good sign. You should stop the Splunk instance (one at a time and in maintenance mode if you are using indexer clustering) and move those existing cold buckets to the cold path. Or if you have the filesystem space and are more comfortable with a copy, you can use cp instead then cleanup the originals after you are sure it worked.

[baldwintm]

Yes, you can move the colddb from the old path to the new path. you will probably have to restart splunk on the indexer after you move them.

If you want to test this without waiting for data to roll, you can move the colddb files for one index, then restart splunk and see if the older data is searchable.