Deployment Architecture

Migrate an index

daniel333
Builder

All,

Our current indexer is our of physical space. We mounted some storage and I'd like to move an index over to the new mount point.

Is there a procedure for this?

My plan was
1) Shutdown Splunk server
2) Copy index over
3) Edit the index.conf to point to the new locations
4) start splunk

Anything I'm missing?

Tags (3)
0 Karma

ChrisG
Splunk Employee
Splunk Employee

There is documentation for this in the Managing Indexes and Clusters manual, see Move the index database.

lguinn2
Legend

That's it. Just be sure to preserve the ownership and permissions for all the files, and be sure to copy all subdirectories.
In Linux, cp -rp should do it...

Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...