Why are changed indexes locations causing issues?

[ajaylowes]

Hi ,

We had an index "abc" storing all data (warm buckets ) to /opt/splunk/var/lib/splunk/abc/db/.

Since we had space issue we changed location from above to /opt/splunkwarm/abc/db .
This was done by pushing changes from Master Cluster Node Since this is clustered environment.

We still have few warm buckets lying at /opt/splunk/var/lib/splunk/abc/db/ which is again causing issues.

Can we move warm buckets from "/opt/splunk/var/lib/splunk/abc/db/" to "/opt/splunkwarm/abc/db" ?

(this needs to be done in all 4 indexers)

[deepashri_123]

Hey@ajaylowes,

Refer these accepted answers:
https://answers.splunk.com/answers/474795/whats-the-best-way-to-migrate-db-from-one-drive-to.html
https://answers.splunk.com/answers/478697/migrating-hotwarm-and-cold-buckets-to-separate-dri.html

Let me know if this helps!!

[ajaylowes]

Hey @deepashri_123,

Thanks for replying. I see someone stated below on "https://answers.splunk.com/answers/474795/whats-the-best-way-to-migrate-db-from-one-drive-to.html" that this won't work in Clustered Environment and we have a multisite clustered environment.

[deepashri_123]

Hey@ajaylowes,

This can be done in case of clustered environment as well, but i would recommend to first test in non-prod environment.
1. Enable maintenance mode.
2. Stop splunk on all indexers.
3. Change the default path.
4. Refer this link http://docs.splunk.com/Documentation/Splunk/7.0.3/Indexer/Moveanindex
5. Start Splunk
6. Disable maintenance mode.

Let me know if this helps!!