Can I copy each index' datamodel_summary directory to a new location, then update indexes.conf with tstatsHomePath to point to the new directory?

[brdr]

Hi,

I recently moved all our indexed data to separate mount points. I followed the procedure outlined in the indexer manual in moving the indexes. What I missed was to set the tstatsHomePath attribute to the new location of the indexed data in the indexes.conf file. Right now I have index data in a new location, but the datamodel_summary in the default location /opt/splunk/var/lib/indexname/datamodel_summary being utilized. Can I shut down Splunk and copy each index's datamodel_summary directory to the new location, then update the indexes.conf with the 'tstatsHomePath' point to the new directory and start up Splunk? Also, do I need to copy the *.dat files to new location for each index?

Thanks

[Heff]

According to http://docs.splunk.com/Documentation/Splunk/latest/admin/indexesconf you can define the following stanzas, so Yes you should be able to shutdown Splunk, move the files and make the change.

tstatsHomePath =
* Required.
* Location where datamodel acceleration TSIDX data for this index should be
stored
* MUST be defined in terms of a volume definition (see volume section below)
* Must restart splunkd after changing this parameter; index reload will not
suffice.
* CAUTION: Path must be writable.
* Defaults to volume:_splunk_summaries/$_index_name/datamodel_summary,
where $_index_name is runtime-expanded to the name of the index

summaryHomePath =
* An absolute path where transparent summarization results for data in this
index should be stored. Must be different for each index and may be on any
disk drive.
* May contain a volume reference (see volume section below).
* Volume reference must be used if data retention based on data size is
desired.
* If not specified, Splunk will use a directory 'summary' in the same
location as homePath
* For example, if homePath is "/opt/splunk/var/lib/splunk/index1/db",
then summaryHomePath would be "/opt/splunk/var/lib/splunk/index1/summary".
* CAUTION: Path must be writable.
* Must restart splunkd after changing this parameter; index reload will not
suffice.
* Defaults to unset.

[brdr]

can I just leave the datamodel_summary and the indexes's .dat file in the /opt/splunk/var/lib directory (default directory)? Then have the buckets in different location (i.e. our hot/warm reside on fast disks at location /data/splunkdb/indexgoeshere on same server)?