so in PowerShell for instance I would CD C:\Program Files\Splunk\bin> then run  splunk _internal call /data/indexes/default.db/roll-hot-buckets –auth admin : password (is this correct syntax?) I believe we only have 1 index, Is there a way on the Splunk web UI to find where the index path is? it also appears that setting variables is optional.  ... View more

I will try and grab the .conf files (would a search of .conf in the search bar of the file directory work>?) I will perform this for the entire splunk directory.  ... View more

You have been very helpful!    The indexer is moving to the D drive.  I'm not sure what you mean by rolling from hot to warm (is this done automatically or will I need to do something first?) IF it is......for the $SPLUNK_HOME/var/lib/splunk (just the highlighted portion will be copied?) or will I be able to go one directory higher (copy the entire lib folder over and replace) ... View more

is there a lot of .conf files?, I wish there was a list of the "default .conf" files that need to be copied over including the paths on windows would make this so much easier.  This part is still confusing me, so it seems that I cannot copy the entire Splunk directory, and I need to take out specific file paths?  after install of Splunk to D drive.  I don't use any apps, I do have licenses and users.  What about dashboards? So my process now based on your feedback will be  1. Upgrade the original splunk server using the guide Splunk-8.2.5-Installation.pdf (It requires me to upgrade to 7.2 --> 8.0 --> 8.2) hoping this doesn't break my splunk server! 2. Install the 8.2 version to my D:\drive, stop splunk (on both ends?) and then copy over the specific directories from old splunk into new splunk on the d drive.  What about copying over the data part? I think the data is stored at c:\program files\splunk\var\lib\default.db\db (something along these lines, its the largest folder in the Splunk directory)  Will I be able to just copy the entire var folder over?  Thanks for your help! ... View more

Okay we'll try this. I changed the index.conf file (all it had was default, "Server name" below it) not sure if this is the correct index.conf file (there seem to be many in different locations?) I think mine was at c:\program files\Splunk\var\local , I changed the system name to the system I plan on installing Splunk on.  We having a very basic barebones install....Splunk enterprise default everything and all we ingest is application, security, system, forwarder event logs (that's the default configuration that Splunk applies) and we configure it to use receiving indexer (no deployment servers) and port 9997 (default) on enterprise receiving indexer port #.  Then we have our dashboards to filter and display the data we want for review.  Does it matter that the location of the Splunk folder will change from c:\program files\ to a data drive -->  d\Splunk (a storage drive )  When I do the Splunk install of enterprise I will change the location to the D drive (where we copied the initial c:\program Files\Splunk folder from original machine) and hopefully it will work. If you have an idea of the file location (default location) of where that index file is that would be helpful. The main reason we are doing this is that our Splunk server is currently on a workstation with a 256gb HD and our Splunk folder is 100 gigabytes, so we want to move it to a file server data drive and have it operate off that.  Thanks again!    ... View more

just one server and an indexer. Thanks for your help ... View more

Also wanted to add should I upgrade the current server to the latest version first ? Then do the copy to the new system. Or do the copy first then upgrade it?  ... View more