Deployment Architecture

if i change my tstatsHomePath location, will splunk move the files?

a212830
Champion

Hi,

I want to move my tstatsHomePath location, so that it follows the same standard as the standard buckets. The data model already exists - if I change it, do I need to stop the data acceleration? And will the existing data get moved?

0 Karma

sloshburch
Ultra Champion

I've never tried this but based on the behavior of other config stuff here's what I'm thinking:

I'm pretty sure we're talking about changing it in a conf file in which case upon restart Splunk will not know about the old location and will just see that the accelerations don't exist in the new location and therefore need to be built. The acceleration files in the old location will persist because there will be no task to clean them up. If there is a way to move (not just change) the location in the UI or REST or CLI, then that's the best bet for having splunk handle the movement of the respective files - but I don't think such a thing exists.

I would suggest stopping the acceleration, seeing if that cleans up the respective files, then implement your change.

Does that jive with what you were asking or did I misunderstand? Let me know because obviously I answered without doing research first.

0 Karma
Get Updates on the Splunk Community!

What the End of Support for Splunk Add-on Builder Means for You

Hello Splunk Community! We want to share an important update regarding the future of the Splunk Add-on Builder ...

Solve, Learn, Repeat: New Puzzle Channel Now Live

Welcome to the Splunk Puzzle PlaygroundIf you are anything like me, you love to solve problems, and what ...

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...