_internal
and _audit
have started to out grow their default location in $SPLUNK_DB. I'd like to relocate them to use the hot and cold mount points that I've created for my indexes. I have some questions?
There isn't anything particularly dangerous about relocating these to another location / filesystem. Make sure you get indexes.conf
correct, of course. (Or just mount the new location right where the old one was). You should plan for splunkd
to be down during the change.