Migrating Splunk data from NFS to Block storage

[brad63]

What is the process from migrating Splunk data from NFS based storage to Block based storage?

[mikelanghorst]

There's nothing really special about NFS when storing the data there (other than performance issues). I'd just use "rsync -avot" to copy over the data. That way you can run it prior to your cutover time to get it close. Then shutdown, rsync a final time, change your configs, and start. When I'd done similar, though on SAN my multi-TB switchover only took about 15min of downtime.

[sowings]

The only comment I'll make here is that if you rsync a bucket in its hot state (a directory name like hot_v1_15) and then later rsync again, but this time the bucket has been moved to warm (a name like db_1381409248_1381408249_15), Splunk will refuse to start because of the collision between the bucket IDs (the _15 at the end).

After your first rsync, but before your cutover, remove any hot buckets from the target system.