Getting Data In

Can I copy each index' datamodel_summary directory to a new location, then update indexes.conf with tstatsHomePath to point to the new directory?

brdr
Contributor

Hi,

I recently moved all our indexed data to separate mount points. I followed the procedure outlined in the indexer manual in moving the indexes. What I missed was to set the tstatsHomePath attribute to the new location of the indexed data in the indexes.conf file. Right now I have index data in a new location, but the datamodel_summary in the default location /opt/splunk/var/lib/indexname/datamodel_summary being utilized. Can I shut down Splunk and copy each index's datamodel_summary directory to the new location, then update the indexes.conf with the 'tstatsHomePath' point to the new directory and start up Splunk? Also, do I need to copy the *.dat files to new location for each index?

Thanks

0 Karma

Heff
Splunk Employee
Splunk Employee

According to http://docs.splunk.com/Documentation/Splunk/latest/admin/indexesconf you can define the following stanzas, so Yes you should be able to shutdown Splunk, move the files and make the change.

tstatsHomePath =
* Required.
* Location where datamodel acceleration TSIDX data for this index should be
stored
* MUST be defined in terms of a volume definition (see volume section below)
* Must restart splunkd after changing this parameter; index reload will not
suffice.
* CAUTION: Path must be writable.
* Defaults to volume:_splunk_summaries/$_index_name/datamodel_summary,
where $_index_name is runtime-expanded to the name of the index

summaryHomePath =
* An absolute path where transparent summarization results for data in this
index should be stored. Must be different for each index and may be on any
disk drive.
* May contain a volume reference (see volume section below).
* Volume reference must be used if data retention based on data size is
desired.
* If not specified, Splunk will use a directory 'summary' in the same
location as homePath
* For example, if homePath is "/opt/splunk/var/lib/splunk/index1/db",
then summaryHomePath would be "/opt/splunk/var/lib/splunk/index1/summary".
* CAUTION: Path must be writable.
* Must restart splunkd after changing this parameter; index reload will not
suffice.
* Defaults to unset.

0 Karma

brdr
Contributor

can I just leave the datamodel_summary and the indexes's .dat file in the /opt/splunk/var/lib directory (default directory)? Then have the buckets in different location (i.e. our hot/warm reside on fast disks at location /data/splunkdb/indexgoeshere on same server)?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...