Getting Data In

Remove data after moving index location

ejwade
Communicator

I just moved my homePath and coldPath to a new location, and wanted to delete the data stored on Splunk's default index location ($SPLUNK_DB). I would leave it, but it's using the bulk of that partition. Can I simply delete these files, or will they fall off from the relocate?

0 Karma
1 Solution

yannK
Splunk Employee
Splunk Employee

If you moved the indexes folders paths, splunk should only know and use the new location for the new data.
You should be able to remove the old folders safely.

BUT : remove the index folders only, but do not delete the kvstore or the other modinputs and persistent storage, those are not indexes, even if they are stored on the same folders.

PS : if you wanted to relocate all of $SPLUNK_HOME. the trick is to edit the etc/splunk-launch.conf to give it a new path.

PS : as the $SPLUNK_DB is a default, it may be used for many indexes (and apps), you can verify if you missed something after a restart (the missing folders will be recreated)

View solution in original post

0 Karma

yannK
Splunk Employee
Splunk Employee

If you moved the indexes folders paths, splunk should only know and use the new location for the new data.
You should be able to remove the old folders safely.

BUT : remove the index folders only, but do not delete the kvstore or the other modinputs and persistent storage, those are not indexes, even if they are stored on the same folders.

PS : if you wanted to relocate all of $SPLUNK_HOME. the trick is to edit the etc/splunk-launch.conf to give it a new path.

PS : as the $SPLUNK_DB is a default, it may be used for many indexes (and apps), you can verify if you missed something after a restart (the missing folders will be recreated)

View solution in original post

0 Karma

ejwade
Communicator

Thanks, @yannK. I was able to delete folders with no issues.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!