Deployment Architecture

splunk 6.4.1 cluster - move defaultdb/main to new location via indexes.conf

bryanwiggins
Path Finder

env:
IDX multi-site cluster (1 master, 3 peers)
2x HF's
2x SH's

I am wanting to move the defaultdb/main index to a bigger disk and I am hoping I can do this via an entry in indexes.conf and pushing via a bundle to the peers.

Is it as straight forward as adding the following to /opt/splunk/etc/master-apps/_cluster/local/indexes.conf (as I do for other indexes I have created)

[main]
repFactor=auto
homePath=/path/to/new/location/db
coldPath=/path/to/new/location/colddb
thawedPath=/path/to/new/location/thaweddb

Then run 'splunk apply cluster-bundle'

Do i have to do anything or will this in effect move the defaultdb/main index to the new path I have already created?

Thx
Bry

Tags (1)
0 Karma
1 Solution

bryanwiggins
Path Finder

Update:

This worked - I added the path in the indexes.conf listed above, applied the bundle and data started flowing to the new path - all paths updated too.

I did create the directory structure first before applying the bundle to the idx peers.

Thx
Bry

View solution in original post

0 Karma

bryanwiggins
Path Finder

Update:

This worked - I added the path in the indexes.conf listed above, applied the bundle and data started flowing to the new path - all paths updated too.

I did create the directory structure first before applying the bundle to the idx peers.

Thx
Bry

0 Karma

bryanwiggins
Path Finder

Update:

This worked - I added the path in the indexes.conf listed above, applied the bundle and data started flowing to the new path - all paths updated too.

I did create the directory structure first before applying the bundle to the idx peers.

Thx
Bry

0 Karma
Get Updates on the Splunk Community!

Celebrating Fast Lane: 2025 Authorized Learning Partner of the Year

At .conf25, Splunk proudly recognized Fast Lane as the 2025 Authorized Learning Partner of the Year. This ...

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...