Getting Data In

How to edit my index to change the cold path?

stcrispan
Communicator

We just got done adding another 6T to our Splunk server. We'd planned to create another directory under $SPLUNK_DB, and then change all the indexes' Cold Path to include that new directory in the path.

However, when I went to change the Cold Path, I found I was unable to change it.

How do I change the cold path?

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi stcrispan,
as described at https://docs.splunk.com/Documentation/Splunk/7.2.6/Indexer/Moveanindex you have to follow these items:

  • create a new directory on the new storage,
  • modify the indexes.conf file where your index is setted inserting the new path for colddb;
  • stop splunk,
  • if there are some data on your colddb copy them in the new location,
  • restart Splunk.

Remember to use an absolute path for the new location.
Otherwise, before restarting your Splunk, you have to repeat the previous process for all the indexes you have and then change DB_PATH variable in $SPLUNK_HOME/etc/splunk-launch.conf.

In this way, your indexes are addressed to the new location.

Bye.
Giuseppe

View solution in original post

stcrispan
Communicator

Thank you!

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi stcrispan,
as described at https://docs.splunk.com/Documentation/Splunk/7.2.6/Indexer/Moveanindex you have to follow these items:

  • create a new directory on the new storage,
  • modify the indexes.conf file where your index is setted inserting the new path for colddb;
  • stop splunk,
  • if there are some data on your colddb copy them in the new location,
  • restart Splunk.

Remember to use an absolute path for the new location.
Otherwise, before restarting your Splunk, you have to repeat the previous process for all the indexes you have and then change DB_PATH variable in $SPLUNK_HOME/etc/splunk-launch.conf.

In this way, your indexes are addressed to the new location.

Bye.
Giuseppe

Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...