Deployment Architecture
Highlighted

Why are changed indexes locations causing issues?

Path Finder

Hi ,

We had an index "abc" storing all data (warm buckets ) to /opt/splunk/var/lib/splunk/abc/db/.

Since we had space issue we changed location from above to /opt/splunkwarm/abc/db .
This was done by pushing changes from Master Cluster Node Since this is clustered environment.

We still have few warm buckets lying at /opt/splunk/var/lib/splunk/abc/db/ which is again causing issues.

Can we move warm buckets from "/opt/splunk/var/lib/splunk/abc/db/" to "/opt/splunkwarm/abc/db" ?

(this needs to be done in all 4 indexers)

0 Karma
Highlighted

Re: Why are changed indexes locations causing issues?

Motivator
0 Karma
Highlighted

Re: Why are changed indexes locations causing issues?

Path Finder

Hey @deepashri_123,

Thanks for replying. I see someone stated below on "https://answers.splunk.com/answers/474795/whats-the-best-way-to-migrate-db-from-one-drive-to.html" that this won't work in Clustered Environment and we have a multisite clustered environment.

0 Karma
Highlighted

Re: Why are changed indexes locations causing issues?

Motivator

Hey@ajaylowes,

This can be done in case of clustered environment as well, but i would recommend to first test in non-prod environment.
1. Enable maintenance mode.
2. Stop splunk on all indexers.
3. Change the default path.
4. Refer this link http://docs.splunk.com/Documentation/Splunk/7.0.3/Indexer/Moveanindex
5. Start Splunk
6. Disable maintenance mode.

Let me know if this helps!!

0 Karma