Relocate KVstore files on filesystem

[jimodonald]

I am extensively using KV Store for a project and have run into an issue with where the files are stored on disk. There is a long sorted history to the disk layout, but I am not delving into that at this time.

The server is a Windows 2012 server running Splunk 6.3.3. The C: drive is 96GB in size (with 9.7GB free) and the F: drive is 2 TB in size (with 1.7 TB free). Splunk is installed to the C: drive as per corporate standards. My KV store is currently 60GB in size. My issue is that the KV store files exist in the default index location at $SPLUNK_HOME$\var\lib\splunk and I do not see any documentation related to relocating the KV store to a different filesystem like is possible with indexes.

I've tried to update the indexes.conf to point it to a different filesystem as follows:

[default]

[kvstore]
homePath   = F:\Splunk\var\lib\splunk\kvstore\db
coldPath   = F:\Splunk\var\lib\splunk\kvstore\colddb
thawedPath = $SPLUNK_DB\kvstore\thaweddb

However that does not move the mongo directory or the dumps directory under the kvstore directory.

I suspect (but have not tried yet) that updating the kvstore stanza to something like:

[kvstore]
mongoPath = F:\Splunk\var\lib\splunk\kvstore\mongo
dumpsPath = F:\Splunk\var\lib\splunk\kvstore\dumps

might to the trick, but thought I'd check with the larger audience before I go breaking stuff.

So how about it? Has anyone successfully relocated the kv store files by using indexes.conf? If so, how did you do it?

Thanks in advance.

[jimodonald]

Put the server.conf into an app and deploy it from your cluster master just like any other app you’d deploy. However it’s generally not recommended to run a kvstore on your indexers.

[marcoscala]

Good question! And what about relocating a single Collection inside the KVStore? I'm generating a sample collection for an app and I'd like to export just that collection instead of all the KV Store.
Is it possible?

marco

[jimodonald · Accepted solution]

I have not tested this yet -- haven't had time yet, but I did find this stanza in server.conf:

[kvstore]
dbPath = <path>
 * Path where KV Store data is stored.
 * Changing this directory after initial startup does not move existing data.
  The contents of the directory should be manually moved to the new
  location.
 * Defaults to $SPLUNK_DB/kvstore.

so in theory you should be able to define the path for the kvstore in server.conf. If you try it out, please post back with your results.

UPDATE: This has been tested successfully and worked exactly like you'd expect it to. Just like moving an index.

[mikelauth]

This worked perfect! Thank you!

[nawazns5038]

How to implement this in a cluster ??

[redflexigork]

Added a stanza in etc\system\local\server.conf. It works, thanks.

[DavidHourani]

hello did you find any solution for that ?