Need to move Splunk install dir

[rhall2016]

Need to move /opt/splunk to /data/splunk due to disk space issues. What is the best way forward with the least downtime?

[woodcock]

The safest way is to:
Add the disk space.
Shut down splunk.
Physically move splunk.
Create a soft link from the old home to the new home (you have no idea how many things are expecting Splunk to be where it used to be).
Start splunk.

[rhall2016]

I'm going to test this tonight and see what I get. sym-links slipped my mind.

[woodcock]

It is super cheap insurance. People forget to check cron and logrotate and all of those other things that might be touching Splunk from the outside.

[gcusello]

Hi rhall2016,
see at https://answers.splunk.com/answers/2338/move-splunk-install-from-one-directory-to-another.html .
You could also see at https://docs.splunk.com/Documentation/Splunk/7.3.0/Installation/MigrateaSplunkinstance .

Bye.
Giuseppe

[rhall2016]

I've read both of those. The details I need is do I leave just a copy of splunk-launch.conf in /opt/splunk/etc and can delete the rest once moved in order to free up the space needed? Is there anything else that is need in the old dir once I change $SPLUNK_HOME to the new dir?

[gcusello]

Hi rhall2016,
you have to:

• add the needed disk space,
• stop Splunk,
• move all the splunk folder in the new location,
• edit and change $SPLUNK_HOME and $SPLUNK_DB in /opt/splunk/server/etc/splunk-launch.conf,
• check if in your apps there are some absolute paths in inputs.conf and eventually update them,
• if you have the automatic start scripts, update them,
• start Splunk.

You don't need to leave anything in Splunk old folder.

Bye.
Giuseppe

[rhall2016]

Tracking now. Thanks for the input.