How to move .dat files after moving indexes to another volume?

New Member


I have moved our $SPLUNK_DB folder to a SSD disk to improve performance.

But I realized that .dat files are still writing in my old $SPLUNK_DB folder ($SPLUNK_HOME/var/lib/splunk) and the index folder has been updated correctly in my new SSD volume.

What files could I delete in my old folder and how I set a configuration to splunk starts writing .dat files in the new $SPLUNK_DB folder?

Obs: I have followed Splunk documentation "How to move splunk index".

Labels (1)
0 Karma

New Member

Anyone could help me understand why .dat files has been populated in /opt/splunk/var/lib/splunk instead of the new storage set in splunk-launch.conf at SPLUNK_DB attribute?

0 Karma


I am curious to know also! I have moved my SPLUNK_DB to a separate drive but the .dat files are still being created/updated to the default location.

0 Karma


Did you change the $SPLUNK_DB folder old path to new path under indexes.conf. This will avoid splunk under default location.

Please go through below link for further clarification,

0 Karma

New Member

Hi, thanks for the fast reply! =]

I did this:

Stopped Splunk

moved the old $SPLUNK_DB($SPLUNK_HOME/var/lib/splunk) to the new one /splunkdb: cp -rp $SPLUNK_DB/* /splunkdb

Created $SPLUNK_DB variable: export SPLUNK_DB=/splunkdb

Changed the SPLUNK_DB=/splunkdb in splunk-launch.conf.

Started Splunk

After that I saw .dat been populated in old folder.

I didn't change any configuration in indexes.conf, do I need to do something there?

0 Karma

Path Finder

Hi dipereira, I am having the same issue. I still see dat files getting generated at default locaton even after I moved DPLUNk_DB path. Did you find any solution?

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...