Restarting Splunk Agent when Home Directory is changed

[_gkollias]

I have some servers that don't comply to our newer Splunk Standards, and I'm doing a "Remediation" on the servers that need home directories changed, increased disk space, etc.

Will Splunkd need to be restarted after changing its home directory?

Thanks

[bandit]

Correct, that will work if running the forwarder as the root account. You'll need sudo or root permissions to run the command.

$SPLUNK_HOME/bin/splunk enable boot-start

If running as a non-root account i.e. splunk, then you'll need to use the -user switch to start it as that user.

$SPLUNK_HOME/bin/splunk enable boot-start -user splunk

[bandit · Accepted solution]

If you are relocating the base install directory of Splunk on Unix, aka SPLUNK_HOME, then yes you would need to stop Splunk, relocate the directory, then start Splunk. On Unix, be sure, to update any boot script paths under /etc/init.d if you have enabled Splunk start on OS reboot.

If you are relocating on Windows, you would likely need to uninstall, then reinstall, first backing up the etc folder for configs you need to save.

[_gkollias]

Thank you, Rob!

I also want to make sure the startup sequence is added. Is that simply $SPLUNK_HOME/bin/splunk enable boot-start?