Splunk Enterprise (Windows): How to move my indexes to new drive?

[OsmanElyas]

I Have Splunk Enterprise (Windows) single entity and the indexes are in the 😧 drive and it is full and I have added new desk F: drive 

I want to move my indexes to the new drive do I need to specify any change related to the new drive

[OsmanElyas]

@richgalloway  I am already started moving  %SPLUNK_DB% files from 😧 to  F:

What is the reference you referring too ( I am using windows server)

[richgalloway]

Your indexes.conf files (there may be several of them)  should contain file paths that tell Splunk where to store data.  Those file paths will contain drive letters that will have to be changed to the new drive.

[richgalloway]

I would shut down Splunk and move the %SPLUNK_DB% files from D to F.  While that is happening, change all references from D to F in indexes.conf.  Then restart Splunk.

[OsmanElyas]

It works but for some app there is time window for the events not as before but I consider it work fine.

@richgalloway  Thanks 

[richgalloway · Accepted solution]

If your problem is resolved, then please click the "Accept as Solution" button to help future readers.