Getting Data In

Transfer existing events to new volume

sigma
Path Finder

Hi all,

I created a volume and changed all homePath for all indexes to use this volume.
Now I can't search on events that existed before this volume was created, and the search heads only show events that are on this volume.
How can I move old and existing events to this volume so I can search on them?

Thank you.

Labels (2)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The old events cannot be searched because they're on the old volume.  Indexers have only one volume definition so they only know the current volume.

Use OS tools to copy the directories from the old volume to the new one then restart the indexers.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

The old events cannot be searched because they're on the old volume.  Indexers have only one volume definition so they only know the current volume.

Use OS tools to copy the directories from the old volume to the new one then restart the indexers.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Get Inspired! We’ve Got Validation that Your Hard Work is Paying Off

We love our Splunk Community and want you to feel inspired by all your hard work! Eric Fusilero, our VP of ...

What's New in Splunk Enterprise 9.4: Features to Power Your Digital Resilience

Hey Splunky People! We are excited to share the latest updates in Splunk Enterprise 9.4. In this release we ...