Relocating _internal and _audit, is it safe?

[colinj]

_internal and _audit have started to out grow their default location in $SPLUNK_DB. I'd like to relocate them to use the hot and cold mount points that I've created for my indexes. I have some questions?

1. Is it safe to relocate the _* indexes?
2. What's the right way to relocate these indexes so that I don't lose any data?

[dwaddle]

There isn't anything particularly dangerous about relocating these to another location / filesystem. Make sure you get indexes.conf correct, of course. (Or just mount the new location right where the old one was). You should plan for splunkd to be down during the change.