I need to change the location of all DB on first run, as the /opt/splunk doesn't have space to support the data.
When I try to put a fresh 7.0.1 extract down for a new install and then before the first start
edit /opt/splunk/etc/splunk-launch.conf
SPLUNK_DB=/san1/splunk_db
It creates the directory structure on first run but brings everything performance wise down to the point that the CLI and web page is unresponsive. Result is an install that is not functional.
I have also tried (to see if the directory is the issue to use /opt/splunk/splunk_db) and had the same issues
If I omit that step and let it create the default path under /opt/splunk/var/lib/splunk it works fine and has no performance issues.
It seems that changing this variable, before first launch, to set the location for ALL DB is no longer correct?
How fast is your SAN? From the looks of it here you are mounting an external filesystem for your hot and warm buckets. If you cant do 1200 IOPS on that device, I'd advise not using it.
This is only on the DEV box to get a fresh 7.x install. Production runs on 6.6.x with dedicated external SAN.
The mount point is just another directory that VMWare presents of the same presented disk. So /san1 or /opt/splunk are no different but made that way to simulate prod visually.
The issue seems to be 7.0.1 not liking me changing that SPLUNK_DB variable. If I do a fresh 6.6.3 it has no issues with it, Fresh 7.0.1 breaks.