Migrating splunk folder to another LVM file system

[chandu245]

I am in need of migrating the splunk folder(/opt/splunk/var/lib/splunk) to another LVM as the current file system is getting filled up. This folder has db and some other files.
Any suggestions or steps?

Found this but steps are not refined - https://answers.splunk.com/answers/3390/how-do-i-move-all-log-data-to-another-filesystem.html

[chandu245]

This is what I followed to get this migrated.

Stop the splunk : service splunk stop
Run the below command : rsync -av /opt/splunk/var/lib/ /splunk_data_vol/
Take a backup of /opt/splunk/etc/splunk-launch.conf
Override the new $SPLUNK_DB path /splunk_data_vol/splunk under /opt/splunk/etc/splunk-launch.conf
Start the splunk : service splunk start

[nickhills · Accepted solution]

The answer from that other post is quite concise, and describes the steps to take if you're going to use a mount to present the new volume.

If you want to move the data to a different path:

Stop Splunk
Copy the contents of $SPLUNK_HOME/var/lib/splunk to your new location.
(You can use @dwaddle's suggested approach of using tar, or cp/rsync or anything else which robustly copies the data, but pay attention to permissions)
Update the path in your indexes.conf to reflect the new data locations.
Start Splunk 

[chandu245]

@nickhillscpl Thanks! Will try this and update over here.