Getting Data In

Moved indexed data to different mount - not seeing it

omuelle1
Communicator

Hi,

I was running out of space due to large volume of vmware data that we are indexing and I had to move the data to a different mount. I changed in index.conf where the data is being indexed and moved all the db folders (hot,warm,cold) and hot folders to the new mount as well. However when running a search the old data is being ignored, can you somehow force the index to reindex data it already indexed before?

Oliver

0 Karma

woodcock
Esteemed Legend

I am sure that you meant indexes.conf but in any case, you clearly did not move the old files to the directory at the new mount point so it created new files. It can be merged but it is tricky and unsupported. Your simplest option is to figure out where the disconnect is, rename the old index and create 2 entries in indexes.conf and then search against both until the old data ages out and get rid of the old index.

omuelle1
Communicator

Sorry I did mean index.conf, so I want to create a new index and have it index that data?

0 Karma

woodcock
Esteemed Legend

The correct name is indexes.conf so if you used index.conf then that is the problem.

0 Karma

omuelle1
Communicator

I know, just made typo..

0 Karma
Get Updates on the Splunk Community!

AI for AppInspect

We’re excited to announce two new updates to AppInspect designed to save you time and make the app approval ...

App Platform's 2025 Year in Review: A Year of Innovation, Growth, and Community

As we step into 2026, it’s the perfect moment to reflect on what an extraordinary year 2025 was for the Splunk ...

Operationalizing Entity Risk Score with Enterprise Security 8.3+

Overview Enterprise Security 8.3 introduces a powerful new feature called “Entity Risk Scoring” (ERS) for ...