Deployment Architecture

Why are changed indexes locations causing issues?

ajaylowes
Path Finder

Hi ,

We had an index "abc" storing all data (warm buckets ) to /opt/splunk/var/lib/splunk/abc/db/.

Since we had space issue we changed location from above to /opt/splunkwarm/abc/db .
This was done by pushing changes from Master Cluster Node Since this is clustered environment.

We still have few warm buckets lying at /opt/splunk/var/lib/splunk/abc/db/ which is again causing issues.

Can we move warm buckets from "/opt/splunk/var/lib/splunk/abc/db/" to "/opt/splunkwarm/abc/db" ?

(this needs to be done in all 4 indexers)

0 Karma

deepashri_123
Motivator
0 Karma

ajaylowes
Path Finder

Hey @deepashri_123,

Thanks for replying. I see someone stated below on "https://answers.splunk.com/answers/474795/whats-the-best-way-to-migrate-db-from-one-drive-to.html" that this won't work in Clustered Environment and we have a multisite clustered environment.

0 Karma

deepashri_123
Motivator

Hey@ajaylowes,

This can be done in case of clustered environment as well, but i would recommend to first test in non-prod environment.
1. Enable maintenance mode.
2. Stop splunk on all indexers.
3. Change the default path.
4. Refer this link http://docs.splunk.com/Documentation/Splunk/7.0.3/Indexer/Moveanindex
5. Start Splunk
6. Disable maintenance mode.

Let me know if this helps!!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...