How to move .dat files after moving indexes to another volume?

New Member


I have moved our $SPLUNK_DB folder to a SSD disk to improve performance.

But I realized that .dat files are still writing in my old $SPLUNK_DB folder ($SPLUNK_HOME/var/lib/splunk) and the index folder has been updated correctly in my new SSD volume.

What files could I delete in my old folder and how I set a configuration to splunk starts writing .dat files in the new $SPLUNK_DB folder?

Obs: I have followed Splunk documentation "How to move splunk index".

Labels (1)
0 Karma

New Member

Anyone could help me understand why .dat files has been populated in /opt/splunk/var/lib/splunk instead of the new storage set in splunk-launch.conf at SPLUNK_DB attribute?

0 Karma

New Member

I am curious to know also! I have moved my SPLUNK_DB to a separate drive but the .dat files are still being created/updated to the default location.

0 Karma


Did you change the $SPLUNK_DB folder old path to new path under indexes.conf. This will avoid splunk under default location.

Please go through below link for further clarification,

0 Karma

New Member

Hi, thanks for the fast reply! =]

I did this:

Stopped Splunk

moved the old $SPLUNK_DB($SPLUNK_HOME/var/lib/splunk) to the new one /splunkdb: cp -rp $SPLUNK_DB/* /splunkdb

Created $SPLUNK_DB variable: export SPLUNK_DB=/splunkdb

Changed the SPLUNK_DB=/splunkdb in splunk-launch.conf.

Started Splunk

After that I saw .dat been populated in old folder.

I didn't change any configuration in indexes.conf, do I need to do something there?

0 Karma

Path Finder

Hi dipereira, I am having the same issue. I still see dat files getting generated at default locaton even after I moved DPLUNk_DB path. Did you find any solution?

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!


Or Learn More in Our Blog >>