Moving Splunk Databases

[Hazel]

Hello,

The mount on our Indexer box that stores the databases and runs splunk is about to run out of memory (is at 99%). We have another mount that has lots of space that we can move stuff to but I am not sure what to move.

I notice that /lib is taking up most of the memory, i think this is where the main dbs are. Is there a way I can move my db to the other mount?

Is it possible to do this easily without upsetting the data?

Hazel

[ftk · Accepted solution]

This question has been addressed in multiple other questions before. Check out the following:

http://answers.splunk.com/questions/3390/how-do-i-move-all-log-data-to-another-filesystem

and

http://answers.splunk.com/questions/3875/moving-splunk-indexer-from-one-host-to-another-host

[Hazel]

Thanks. I think I actually want to reword my question to look at a better solution. Will delete this and raise another