I have a new indexer set up for dev, and I need to move its default SPLUNK_DB path to the mountpoints we have set up for its cold/data
Currently, we have storage allocated on drives for the cold and hot data.
We have storage allocated at /export/opt/slunk/data/<cold|hot>
Currently, I have ingested some test data with eventgen, and it ended up in /export/opt/splunk/var/lib/splunk/
I would just copy everything over and update the splunk-launch.conf and edit the $SPLUNK_DB to be /export/opt/splunk/data, but there are a lot of files under the /export/opt/splunk/var/lib/splunk/.
I really only have one index with data in it, the testindex index.
What would be the best way to go about migrating all of the data from /export/opt/splunk/var/lib/splunk/ while making sure that future events get sent to the correct hot/cold databases.
The files under /export/opt/splunk/var/lib/splunk/ dont specify hot or cold until i get into the specific directories. At this point, all of the data could be considered hot as its new, but id like to confirm that any future events get sent to the correct index.
When i run echo $SPLUNK_DB, i do not get any output. When i run printenv, I do not see $SPLUNK_HOME or $SPLUNK_DB and their values. WIthin the SPlunk-launch.conf, the $SPLUNK_DB is commented out, and there isnt one set in local to specify it. So why does it default to /export/opt/splunk/var/lib/splunk/?
I saw this Splunk DOC:https://docs.splunk.com/Documentation/Splunk/9.2.1/Indexer/Moveanindex
But I already have a directory i want, would i have to move each folder under the current db directory individually to ensure they land in the right place?
Id just like some guidance on best practice for this indexer. I just have one SH, one Indexer, and one Forwarder.
Thanks for any help
