I have not done this before and I am not sure what the best way to move older data in to the warm buckets?
The objective is to move the older data to the faster drives back in the hot/warm buckets.
IF you could provide an example that would be great.
Any advice or reference is appreciated. The environment is 6.3 or higher.
The index storage will have separate folders for hot/warm buckets (default location $SplunkHome/var/lib/splunk/IndexNameHere/db) and cold buckets (default location $SplunkHome/var/lib/splunk/IndexNameHere/colddb). Assuming your IndexNameHere/db is hosted in faster drive already, do you want to host IndexNameHere/colddb also in same faster drive?
Thank you somesoni2, yes as you stated its a simple linux directory move that I am dealing with. I thought it was more complicated. Please convert your reply to answer and I will accept. Thank you