I have moved our $SPLUNK_DB folder to a SSD disk to improve performance.
But I realized that .dat files are still writing in my old $SPLUNK_DB folder ($SPLUNK_HOME/var/lib/splunk) and the index folder has been updated correctly in my new SSD volume.
What files could I delete in my old folder and how I set a configuration to splunk starts writing .dat files in the new $SPLUNK_DB folder?
Obs: I have followed Splunk documentation "How to move splunk index".
Did you change the $SPLUNK_DB folder old path to new path under indexes.conf. This will avoid splunk under default location.
Please go through below link for further clarification,
Hi, thanks for the fast reply! =]
I did this:
moved the old $SPLUNK_DB($SPLUNK_HOME/var/lib/splunk) to the new one /splunkdb: cp -rp $SPLUNK_DB/* /splunkdb
Created $SPLUNK_DB variable: export SPLUNK_DB=/splunkdb
Changed the SPLUNK_DB=/splunkdb in splunk-launch.conf.
After that I saw .dat been populated in old folder.
I didn't change any configuration in indexes.conf, do I need to do something there?