Splunk Search

Hard Disk Change on the Indexers

athorat
Communicator

We have a clustered environment.
3 Indexers , 1 search head, 1 cluster master , 4 heavy forwarders and 100+ universal forwarders
The Infrastructure team wants to change the Hard Drives on the existing Splunk Infrastructure.

How can we move the indexer data/information from one hard drive to another without any data loss.

Thanks.

Tags (1)
0 Karma

MuS
SplunkTrust
SplunkTrust

Hi athorat,

take a look at the docs http://docs.splunk.com/Documentation/Splunk/6.3.0/Indexer/Moveanindex about moving an index to a different file system / disk. As well take a look at this answer http://answers.splunk.com/answers/149248/how-to-move-index-from-one-hard-drive-to-another-in-splunk-... which covers the cluster index move.

Hope this helps ...

cheers, MuS

0 Karma

athorat
Communicator

Hi @MuS

We will not be changing the actual physical servers.
In this case when we get a new HDD can we not just replicate the content on the drive and use the new Drive?
Not sure if it makes sense...

Thanks.

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi athorat,

sure, this can be done as well. Just make sure the $SPLUNK_DB path matches the new disks and all is good.

cheers, MuS

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...