Getting Data In

Moved indexed data to different mount - not seeing it

omuelle1
Communicator

Hi,

I was running out of space due to large volume of vmware data that we are indexing and I had to move the data to a different mount. I changed in index.conf where the data is being indexed and moved all the db folders (hot,warm,cold) and hot folders to the new mount as well. However when running a search the old data is being ignored, can you somehow force the index to reindex data it already indexed before?

Oliver

0 Karma

woodcock
Esteemed Legend

I am sure that you meant indexes.conf but in any case, you clearly did not move the old files to the directory at the new mount point so it created new files. It can be merged but it is tricky and unsupported. Your simplest option is to figure out where the disconnect is, rename the old index and create 2 entries in indexes.conf and then search against both until the old data ages out and get rid of the old index.

omuelle1
Communicator

Sorry I did mean index.conf, so I want to create a new index and have it index that data?

0 Karma

woodcock
Esteemed Legend

The correct name is indexes.conf so if you used index.conf then that is the problem.

0 Karma

omuelle1
Communicator

I know, just made typo..

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Rounding off the Splunk Dashboard Contest

What does a contest-winning Splunk dashboard look like? In this case, it isn't in a browser tab at all. It ...

A Four Part Event Series: AI + Observability: AI Agents, LLMs, Apps, & Infrastructure

AI + Observability: AI Agents, LLMs, Apps, & Infrastructure The rapid evolution of artificial intelligence ...