If you have a volume with space available you could mount that 'over the top' or 'within' your Splunk filesystem.
In deployments I have worked on, it's common to do both!
For indexers in particular, there is performance optimization by using different classes of storage volume for different bucket types.
You might therefore have a separate volume mounted as /opt/splunk, and different volumes also mounted in /opt/splunk/var/li b/splunk/[hot|cold|frozen]/
If you have a volume to use for this, the safest way is to stop Splunk, rsync the contents of your old /opt/splunk to your new volume, then mount the new volume over the top of /opt/splunk and start Splunk to test.
If my comment helps, please give it a thumbs up!
