Have a 4.1.4 install on Windows 2008 R2 that I would like to improve performance on. Indexes stored on dedicated RAID-5 volume after setting path in splunk-launch.conf.
I see disk activity on the system OS RAID-1 volume (C:\Program Files\Splunk\var) that I would like to move to a different RAID-5 volume from the indexes.
Can this be performed without a reinstall? Changing SPLUNK_HOME in splunk-launch.conf seemed to prevent the splunkd process from starting.
Changing $SPLUNK_HOME
is best done with a reinstall, but if you just want to move the indexes, it's overkill.
Instead, change $SPLUNK_DB
.
Take a look at:
http://www.splunk.com/base/Documentation/4.1.5/Admin/Moveanindex
It does't mention it in the docs page, but you should also review any indexes.conf files, looking for any hard-coded paths. Most paths should already be relative to $SPLUNK_DB
.
Changing $SPLUNK_HOME
is best done with a reinstall, but if you just want to move the indexes, it's overkill.
Instead, change $SPLUNK_DB
.
Take a look at:
http://www.splunk.com/base/Documentation/4.1.5/Admin/Moveanindex
It does't mention it in the docs page, but you should also review any indexes.conf files, looking for any hard-coded paths. Most paths should already be relative to $SPLUNK_DB
.
Reinstall is the approach I took to reset SPLUNK_HOME.