Splunk Search

Hard Disk Change on the Indexers

athorat
Communicator

We have a clustered environment.
3 Indexers , 1 search head, 1 cluster master , 4 heavy forwarders and 100+ universal forwarders
The Infrastructure team wants to change the Hard Drives on the existing Splunk Infrastructure.

How can we move the indexer data/information from one hard drive to another without any data loss.

Thanks.

Tags (1)
0 Karma

MuS
SplunkTrust
SplunkTrust

Hi athorat,

take a look at the docs http://docs.splunk.com/Documentation/Splunk/6.3.0/Indexer/Moveanindex about moving an index to a different file system / disk. As well take a look at this answer http://answers.splunk.com/answers/149248/how-to-move-index-from-one-hard-drive-to-another-in-splunk-... which covers the cluster index move.

Hope this helps ...

cheers, MuS

0 Karma

athorat
Communicator

Hi @MuS

We will not be changing the actual physical servers.
In this case when we get a new HDD can we not just replicate the content on the drive and use the new Drive?
Not sure if it makes sense...

Thanks.

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi athorat,

sure, this can be done as well. Just make sure the $SPLUNK_DB path matches the new disks and all is good.

cheers, MuS

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...