moving indexes and .dat files

[brdr]

We using Splunk Enterprise, 5.2.2 on Linux. We are moving the indexes to different storage devices depending on the buckets (hot/warm, cold, etc..). We will the volume stanza in the indexes.conf to manage this. Question, what is the .dat files used for found in /opt/splunk/var/lib/splunk for each of the indexes? And, do you I need to move them to the hot/warm db location - how do I manage these going forward after indexes have been appropriately moved?

Thx

[baldwintm]

This question was answered in https://answers.splunk.com/answers/442499/why-are-we-seeing-dat-files-created-in-the-cold-to.html

"These .dat files hold the next bucket ID to be created for that index, and they aren't influenced by homePath etc. settings in indexes.conf."

[lycollicott]

Are you talking about splunk-autogen-params.dat? It is sort of scratch space where splunkd writes information about how it is managing the buck. (I'm not sure what that information means though.)

You need to move the entire bucket folders, including splunk-autogen-params.dat. Everything in the bucket folder has to move together.

[brdr]

Thank you the response. but my question wasn't around indexes, rather what is the .dat files for and what to do, if anything, once the indexes have been moved appropriately.

[gcusello]

Indexes configuration is in indexes.conf, that you can find in your app or in $SPLUNK_HOME/etc/system/local.

You can know where is your indexes.conf using web interface [Settings -- Indexes] at the App column:
- if there is system, you can find in $SPLUNK_HOME/etc/system/local;
- if there's an app, you can find in $SPLUNK_HOME/etc/apps/yourapp/local,
- sometimes it's in launcher app.

To move an index you have to do:
- stop Splunk,
- move the full directory of your index to the new path,
- modify indexes.conf with the new path,
- restart Splunk.

in indexes.conf you probably have $SPLUNK_DB/yourindex, you have to modify $SPLUNK_DB in the new path of your index.

Bye.
Giuseppe