Getting Data In

Transfer existing events to new volume

sigma
Path Finder

Hi all,

I created a volume and changed all homePath for all indexes to use this volume.
Now I can't search on events that existed before this volume was created, and the search heads only show events that are on this volume.
How can I move old and existing events to this volume so I can search on them?

Thank you.

Labels (2)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The old events cannot be searched because they're on the old volume.  Indexers have only one volume definition so they only know the current volume.

Use OS tools to copy the directories from the old volume to the new one then restart the indexers.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

The old events cannot be searched because they're on the old volume.  Indexers have only one volume definition so they only know the current volume.

Use OS tools to copy the directories from the old volume to the new one then restart the indexers.

---
If this reply helps you, Karma would be appreciated.
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...