Remove data after moving index location

[ejwade]

I just moved my homePath and coldPath to a new location, and wanted to delete the data stored on Splunk's default index location ($SPLUNK_DB). I would leave it, but it's using the bulk of that partition. Can I simply delete these files, or will they fall off from the relocate?

[yannK · Accepted solution]

If you moved the indexes folders paths, splunk should only know and use the new location for the new data.
You should be able to remove the old folders safely.

BUT : remove the index folders only, but do not delete the kvstore or the other modinputs and persistent storage, those are not indexes, even if they are stored on the same folders.

PS : if you wanted to relocate all of $SPLUNK_HOME. the trick is to edit the etc/splunk-launch.conf to give it a new path.

PS : as the $SPLUNK_DB is a default, it may be used for many indexes (and apps), you can verify if you missed something after a restart (the missing folders will be recreated)

[ejwade]

Thanks, @yannK. I was able to delete folders with no issues.