Getting Data In

Vmware Indexers | How do I increase the size of the drive where my logs are indexed?

GaetanVP
Contributor

Hello Splunk commu!

I am using Indexers as Virtual Machine in VMWare, and I would like to increase the size of the drive where my logs are indexed. 

I am using lvm and I would like to know if there are some best practices to follow before extending the drive size on VMware side. Do I need to stop Splunk on the indexers before increasing the drive size ? What are the potential risks during this operation ? 

Thanks a lot for your help! 

Labels (1)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

I'd say that theoretically, any operation on a live system involves some risk. So proper change management should account for that and should have some recovery plan in case something does fail.

Having said that - it shouldn't be that different of any other disk resize operation. Extending the disks may involve some increased I/O usage due to disk zeroing which may lead to lowered indexer performance.

Apart from that - it depends what is your disk layout - whether you have separate disk for splunk data, or just use one big device for OS and data, whether you use LVM and so on.

In general - you should be able to relatively painlessly extend the disk and the filesystem residing on it unless OS prohibits it, because - for example - you need to adjust partition sizes and the OS won't let youl So it's more of a question to your sysadmins than to splunk admin.

Edit: OK, you wrote that you're using LVM. You should be able to add some additional space to the volume pretty easily then. I don't see any big risks. Just the usual, as with any change - anything can go wrong :slightly_smiling_face:

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...