Hi all,
I'm dealing with a legacy Splunk installation where I'd like to clean up an index for consistency.
Lets say I have an index called 'mydata'. This index is active and has events indexed there fairly regularly (i.e. many times a minute)
Previously, this index was defined manually in /opt/splunk/etc/system/local/indexes.conf.
The home path was specified as /opt/splunk/var/lib/splunk/mydatadb/db'. (NOTE: the folder 'mydatadb' in the path)
Most of our other indexes use the notation of having the home path folder the same name as the index. I would like to migrate this existing index to use this pattern.
Can I simply update indexes.conf to use '/opt/splunk/var/lib/splunk/mydata/db' then manually rename the folder in the filesystem, and restart the indexer?
Is there any metadata or anything else in the db that would cause this path change to break the indexed data?
Hi @joshuapetitt,
if you would move an index from a location to another one, as you can read at https://docs.splunk.com/Documentation/Splunk/8.0.5/Indexer/Moveanindex , you can move an index following this approach:
If instead you want to change the Index name (and folder) I'm not sure that's possible and the best approach could be:
Ciao.
Giuseppe