Can I manually rename an index homePath with existing data?

[joshuapetitt]

Hi all,

I'm dealing with a legacy Splunk installation where I'd like to clean up an index for consistency.

Lets say I have an index called 'mydata'.  This index is active and has events indexed there fairly regularly (i.e. many times a minute)

Previously, this index was defined manually in /opt/splunk/etc/system/local/indexes.conf.

The home path was specified as /opt/splunk/var/lib/splunk/mydatadb/db'.  (NOTE: the folder 'mydatadb' in the path)

Most of our other indexes use the notation of having the home path folder the same name as the index.  I would like to migrate this existing index to use this pattern.

Can I simply update indexes.conf to use '/opt/splunk/var/lib/splunk/mydata/db' then manually rename the folder in the filesystem, and restart the indexer?

Is there any metadata or anything else in the db that would cause this path change to break the indexed data?

[gcusello]

Hi @joshuapetitt,

if you would move an index from a location to another one, as you can read at https://docs.splunk.com/Documentation/Splunk/8.0.5/Indexer/Moveanindex , you can move an index following this approach:

• stop Splunk,
• change indexes.conf where i defined the index,
• move the intere folder in the new location,
• restart Splunk.

If instead you want to change the Index name (and folder) I'm not sure that's possible and the best approach could be:

• create the new index,
• stop the ingesting flow,
• move the ingesting flow to the new index,
• export all the old events from the old one and reindex them,
• enable the ingesting flow.

Ciao.

Giuseppe