Getting Data In

Migrating splunk folder to another LVM file system

chandu245
Explorer

I am in need of migrating the splunk folder(/opt/splunk/var/lib/splunk) to another LVM as the current file system is getting filled up. This folder has db and some other files.
Any suggestions or steps?

Found this but steps are not refined - https://answers.splunk.com/answers/3390/how-do-i-move-all-log-data-to-another-filesystem.html

Tags (1)
0 Karma
1 Solution

nickhills
Ultra Champion

The answer from that other post is quite concise, and describes the steps to take if you're going to use a mount to present the new volume.

If you want to move the data to a different path:

Stop Splunk
Copy the contents of $SPLUNK_HOME/var/lib/splunk to your new location.
(You can use @dwaddle's suggested approach of using tar, or cp/rsync or anything else which robustly copies the data, but pay attention to permissions)
Update the path in your indexes.conf to reflect the new data locations.
Start Splunk 
If my comment helps, please give it a thumbs up!

View solution in original post

0 Karma

chandu245
Explorer

This is what I followed to get this migrated.

Stop the splunk : service splunk stop
Run the below command : rsync -av /opt/splunk/var/lib/ /splunk_data_vol/
Take a backup of /opt/splunk/etc/splunk-launch.conf
Override the new $SPLUNK_DB path /splunk_data_vol/splunk under /opt/splunk/etc/splunk-launch.conf
Start the splunk : service splunk start

0 Karma

nickhills
Ultra Champion

The answer from that other post is quite concise, and describes the steps to take if you're going to use a mount to present the new volume.

If you want to move the data to a different path:

Stop Splunk
Copy the contents of $SPLUNK_HOME/var/lib/splunk to your new location.
(You can use @dwaddle's suggested approach of using tar, or cp/rsync or anything else which robustly copies the data, but pay attention to permissions)
Update the path in your indexes.conf to reflect the new data locations.
Start Splunk 
If my comment helps, please give it a thumbs up!

View solution in original post

0 Karma

chandu245
Explorer

@nickhillscpl Thanks! Will try this and update over here.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!