Hi ,
We had an index "abc" storing all data (warm buckets ) to /opt/splunk/var/lib/splunk/abc/db/.
Since we had space issue we changed location from above to /opt/splunkwarm/abc/db .
This was done by pushing changes from Master Cluster Node Since this is clustered environment.
We still have few warm buckets lying at /opt/splunk/var/lib/splunk/abc/db/ which is again causing issues.
Can we move warm buckets from "/opt/splunk/var/lib/splunk/abc/db/" to "/opt/splunkwarm/abc/db" ?
(this needs to be done in all 4 indexers)
Hey@ajaylowes,
Refer these accepted answers:
https://answers.splunk.com/answers/474795/whats-the-best-way-to-migrate-db-from-one-drive-to.html
https://answers.splunk.com/answers/478697/migrating-hotwarm-and-cold-buckets-to-separate-dri.html
Let me know if this helps!!
Hey @deepashri_123,
Thanks for replying. I see someone stated below on "https://answers.splunk.com/answers/474795/whats-the-best-way-to-migrate-db-from-one-drive-to.html" that this won't work in Clustered Environment and we have a multisite clustered environment.
Hey@ajaylowes,
This can be done in case of clustered environment as well, but i would recommend to first test in non-prod environment.
1. Enable maintenance mode.
2. Stop splunk on all indexers.
3. Change the default path.
4. Refer this link http://docs.splunk.com/Documentation/Splunk/7.0.3/Indexer/Moveanindex
5. Start Splunk
6. Disable maintenance mode.
Let me know if this helps!!