I have moved our $SPLUNK_DB folder to a SSD disk to improve performance.
But I realized that .dat files are still writing in my old $SPLUNK_DB folder ($SPLUNK_HOME/var/lib/splunk) and the index folder has been updated correctly in my new SSD volume.
What files could I delete in my old folder and how I set a configuration to splunk starts writing .dat files in the new $SPLUNK_DB folder?
Obs: I have followed Splunk documentation "How to move splunk index".
Anyone could help me understand why .dat files has been populated in /opt/splunk/var/lib/splunk instead of the new storage set in splunk-launch.conf at SPLUNK_DB attribute?
I am curious to know also! I have moved my SPLUNK_DB to a separate drive but the .dat files are still being created/updated to the default location.
Did you change the $SPLUNK_DB folder old path to new path under indexes.conf. This will avoid splunk under default location.
Please go through below link for further clarification,
Hi, thanks for the fast reply! =]
I did this:
moved the old $SPLUNK_DB($SPLUNK_HOME/var/lib/splunk) to the new one /splunkdb: cp -rp $SPLUNK_DB/* /splunkdb
Created $SPLUNK_DB variable: export SPLUNK_DB=/splunkdb
Changed the SPLUNK_DB=/splunkdb in splunk-launch.conf.
After that I saw .dat been populated in old folder.
I didn't change any configuration in indexes.conf, do I need to do something there?
Hi dipereira, I am having the same issue. I still see dat files getting generated at default locaton even after I moved DPLUNk_DB path. Did you find any solution?