I just built a shiny new 6.4 Index and SH Cluster and need to put all clustered indexes on a larger faster 3TB drive. The cluster is up and running, how is this accomplished? I have read many articles but none really seem comprehensive. Hopefully I get an answer soon because I am at a stopping point in my install without this working!
LOL I LOVE IT!!!! You made my day with that response... Clearly had too much coffee, that's supposed to me move not love 🙂
OK, enough silliness. I updated the Question text. For those of you who are now scratching your heads wondering what we are snickering about, the original text had "love" instead of "move"! It is easy to love shiny new clusters with large hard drives.
I would answer if I had experience here but I don't. Plenty of people do, though, so I am sure you will get some help. If not, at least we both had a laugh.
For now what I did is redefine SPLUNK_DB in ../etc/splunk-launch.conf ... It seems to have worked as it created all the new indexes on both nodes in the cluster, but it seems to me that there is a better way to do this?!?!
What you did is the documented way of moving the location of your index data store for all indices.
If you feel that the documentation link leaves open questions, we love 😉 to get feedback via the "Post Comment" section at the bottom of each page.