Deployment Architecture

splunk 6.4.1 cluster - move defaultdb/main to new location via indexes.conf

bryanwiggins
Path Finder

env:
IDX multi-site cluster (1 master, 3 peers)
2x HF's
2x SH's

I am wanting to move the defaultdb/main index to a bigger disk and I am hoping I can do this via an entry in indexes.conf and pushing via a bundle to the peers.

Is it as straight forward as adding the following to /opt/splunk/etc/master-apps/_cluster/local/indexes.conf (as I do for other indexes I have created)

[main]
repFactor=auto
homePath=/path/to/new/location/db
coldPath=/path/to/new/location/colddb
thawedPath=/path/to/new/location/thaweddb

Then run 'splunk apply cluster-bundle'

Do i have to do anything or will this in effect move the defaultdb/main index to the new path I have already created?

Thx
Bry

Tags (1)
0 Karma
1 Solution

bryanwiggins
Path Finder

Update:

This worked - I added the path in the indexes.conf listed above, applied the bundle and data started flowing to the new path - all paths updated too.

I did create the directory structure first before applying the bundle to the idx peers.

Thx
Bry

View solution in original post

0 Karma

bryanwiggins
Path Finder

Update:

This worked - I added the path in the indexes.conf listed above, applied the bundle and data started flowing to the new path - all paths updated too.

I did create the directory structure first before applying the bundle to the idx peers.

Thx
Bry

0 Karma

bryanwiggins
Path Finder

Update:

This worked - I added the path in the indexes.conf listed above, applied the bundle and data started flowing to the new path - all paths updated too.

I did create the directory structure first before applying the bundle to the idx peers.

Thx
Bry

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...