Getting Data In

Remove data after moving index location

ejwade
Contributor

I just moved my homePath and coldPath to a new location, and wanted to delete the data stored on Splunk's default index location ($SPLUNK_DB). I would leave it, but it's using the bulk of that partition. Can I simply delete these files, or will they fall off from the relocate?

0 Karma
1 Solution

yannK
Splunk Employee
Splunk Employee

If you moved the indexes folders paths, splunk should only know and use the new location for the new data.
You should be able to remove the old folders safely.

BUT : remove the index folders only, but do not delete the kvstore or the other modinputs and persistent storage, those are not indexes, even if they are stored on the same folders.

PS : if you wanted to relocate all of $SPLUNK_HOME. the trick is to edit the etc/splunk-launch.conf to give it a new path.

PS : as the $SPLUNK_DB is a default, it may be used for many indexes (and apps), you can verify if you missed something after a restart (the missing folders will be recreated)

View solution in original post

0 Karma

yannK
Splunk Employee
Splunk Employee

If you moved the indexes folders paths, splunk should only know and use the new location for the new data.
You should be able to remove the old folders safely.

BUT : remove the index folders only, but do not delete the kvstore or the other modinputs and persistent storage, those are not indexes, even if they are stored on the same folders.

PS : if you wanted to relocate all of $SPLUNK_HOME. the trick is to edit the etc/splunk-launch.conf to give it a new path.

PS : as the $SPLUNK_DB is a default, it may be used for many indexes (and apps), you can verify if you missed something after a restart (the missing folders will be recreated)

0 Karma

ejwade
Contributor

Thanks, @yannK. I was able to delete folders with no issues.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...

SplunkTrust | 2024 SplunkTrust Application Period is Open!

It's that time again, folks! That's right, the application/nomination period for the 2024 SplunkTrust is ...