How to move .dat files after moving indexes to another volume?

[dipereira]

Hello,

I have moved our $SPLUNK_DB folder to a SSD disk to improve performance.

But I realized that .dat files are still writing in my old $SPLUNK_DB folder ($SPLUNK_HOME/var/lib/splunk) and the index folder has been updated correctly in my new SSD volume.

What files could I delete in my old folder and how I set a configuration to splunk starts writing .dat files in the new $SPLUNK_DB folder?

Obs: I have followed Splunk documentation "How to move splunk index".

[dipereira]

Anyone could help me understand why .dat files has been populated in /opt/splunk/var/lib/splunk instead of the new storage set in splunk-launch.conf at SPLUNK_DB attribute?

[kmjefferson42]

I am curious to know also! I have moved my SPLUNK_DB to a separate drive but the .dat files are still being created/updated to the default location.

[sbbadri]

Did you change the $SPLUNK_DB folder old path to new path under indexes.conf. This will avoid splunk under default location.

Please go through below link for further clarification,

https://answers.splunk.com/answers/149248/how-to-move-index-from-one-hard-drive-to-another-in-splunk...

[dipereira]

Hi, thanks for the fast reply! =]

I did this:

Stopped Splunk

moved the old $SPLUNK_DB($SPLUNK_HOME/var/lib/splunk) to the new one /splunkdb: cp -rp $SPLUNK_DB/* /splunkdb

Created $SPLUNK_DB variable: export SPLUNK_DB=/splunkdb

Changed the SPLUNK_DB=/splunkdb in splunk-launch.conf.

Started Splunk

After that I saw .dat been populated in old folder.

I didn't change any configuration in indexes.conf, do I need to do something there?

[rteja9]

Hi dipereira, I am having the same issue. I still see dat files getting generated at default locaton even after I moved DPLUNk_DB path. Did you find any solution?