Deployment Architecture

Why are changed indexes locations causing issues?

Path Finder

Hi ,

We had an index "abc" storing all data (warm buckets ) to /opt/splunk/var/lib/splunk/abc/db/.

Since we had space issue we changed location from above to /opt/splunkwarm/abc/db .
This was done by pushing changes from Master Cluster Node Since this is clustered environment.

We still have few warm buckets lying at /opt/splunk/var/lib/splunk/abc/db/ which is again causing issues.

Can we move warm buckets from "/opt/splunk/var/lib/splunk/abc/db/" to "/opt/splunkwarm/abc/db" ?

(this needs to be done in all 4 indexers)

0 Karma

0 Karma

Path Finder

Hey @deepashri_123,

Thanks for replying. I see someone stated below on "" that this won't work in Clustered Environment and we have a multisite clustered environment.

0 Karma



This can be done in case of clustered environment as well, but i would recommend to first test in non-prod environment.
1. Enable maintenance mode.
2. Stop splunk on all indexers.
3. Change the default path.
4. Refer this link
5. Start Splunk
6. Disable maintenance mode.

Let me know if this helps!!

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!