Getting Data In

Change SPLUNK_HOME after install on Windows?

Explorer

Have a 4.1.4 install on Windows 2008 R2 that I would like to improve performance on. Indexes stored on dedicated RAID-5 volume after setting path in splunk-launch.conf.

I see disk activity on the system OS RAID-1 volume (C:\Program Files\Splunk\var) that I would like to move to a different RAID-5 volume from the indexes.

Can this be performed without a reinstall? Changing SPLUNK_HOME in splunk-launch.conf seemed to prevent the splunkd process from starting.

Tags (2)
0 Karma
1 Solution

Motivator

Changing $SPLUNK_HOME is best done with a reinstall, but if you just want to move the indexes, it's overkill.

Instead, change $SPLUNK_DB.

Take a look at:
     http://www.splunk.com/base/Documentation/4.1.5/Admin/Moveanindex

It does't mention it in the docs page, but you should also review any indexes.conf files, looking for any hard-coded paths. Most paths should already be relative to $SPLUNK_DB.

View solution in original post

Motivator

Changing $SPLUNK_HOME is best done with a reinstall, but if you just want to move the indexes, it's overkill.

Instead, change $SPLUNK_DB.

Take a look at:
     http://www.splunk.com/base/Documentation/4.1.5/Admin/Moveanindex

It does't mention it in the docs page, but you should also review any indexes.conf files, looking for any hard-coded paths. Most paths should already be relative to $SPLUNK_DB.

View solution in original post

Explorer

Reinstall is the approach I took to reset SPLUNK_HOME.

0 Karma