Getting Data In

Moved indexed data to different mount - not seeing it

omuelle1
Communicator

Hi,

I was running out of space due to large volume of vmware data that we are indexing and I had to move the data to a different mount. I changed in index.conf where the data is being indexed and moved all the db folders (hot,warm,cold) and hot folders to the new mount as well. However when running a search the old data is being ignored, can you somehow force the index to reindex data it already indexed before?

Oliver

0 Karma

woodcock
Esteemed Legend

I am sure that you meant indexes.conf but in any case, you clearly did not move the old files to the directory at the new mount point so it created new files. It can be merged but it is tricky and unsupported. Your simplest option is to figure out where the disconnect is, rename the old index and create 2 entries in indexes.conf and then search against both until the old data ages out and get rid of the old index.

omuelle1
Communicator

Sorry I did mean index.conf, so I want to create a new index and have it index that data?

0 Karma

woodcock
Esteemed Legend

The correct name is indexes.conf so if you used index.conf then that is the problem.

0 Karma

omuelle1
Communicator

I know, just made typo..

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...