Deployment Architecture

Why are changed indexes locations causing issues?

ajaylowes
Path Finder

Hi ,

We had an index "abc" storing all data (warm buckets ) to /opt/splunk/var/lib/splunk/abc/db/.

Since we had space issue we changed location from above to /opt/splunkwarm/abc/db .
This was done by pushing changes from Master Cluster Node Since this is clustered environment.

We still have few warm buckets lying at /opt/splunk/var/lib/splunk/abc/db/ which is again causing issues.

Can we move warm buckets from "/opt/splunk/var/lib/splunk/abc/db/" to "/opt/splunkwarm/abc/db" ?

(this needs to be done in all 4 indexers)

0 Karma

deepashri_123
Motivator
0 Karma

ajaylowes
Path Finder

Hey @deepashri_123,

Thanks for replying. I see someone stated below on "https://answers.splunk.com/answers/474795/whats-the-best-way-to-migrate-db-from-one-drive-to.html" that this won't work in Clustered Environment and we have a multisite clustered environment.

0 Karma

deepashri_123
Motivator

Hey@ajaylowes,

This can be done in case of clustered environment as well, but i would recommend to first test in non-prod environment.
1. Enable maintenance mode.
2. Stop splunk on all indexers.
3. Change the default path.
4. Refer this link http://docs.splunk.com/Documentation/Splunk/7.0.3/Indexer/Moveanindex
5. Start Splunk
6. Disable maintenance mode.

Let me know if this helps!!

0 Karma
Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...