Getting Data In

Remove data after moving index location

ejwade
Contributor

I just moved my homePath and coldPath to a new location, and wanted to delete the data stored on Splunk's default index location ($SPLUNK_DB). I would leave it, but it's using the bulk of that partition. Can I simply delete these files, or will they fall off from the relocate?

0 Karma
1 Solution

yannK
Splunk Employee
Splunk Employee

If you moved the indexes folders paths, splunk should only know and use the new location for the new data.
You should be able to remove the old folders safely.

BUT : remove the index folders only, but do not delete the kvstore or the other modinputs and persistent storage, those are not indexes, even if they are stored on the same folders.

PS : if you wanted to relocate all of $SPLUNK_HOME. the trick is to edit the etc/splunk-launch.conf to give it a new path.

PS : as the $SPLUNK_DB is a default, it may be used for many indexes (and apps), you can verify if you missed something after a restart (the missing folders will be recreated)

View solution in original post

0 Karma

yannK
Splunk Employee
Splunk Employee

If you moved the indexes folders paths, splunk should only know and use the new location for the new data.
You should be able to remove the old folders safely.

BUT : remove the index folders only, but do not delete the kvstore or the other modinputs and persistent storage, those are not indexes, even if they are stored on the same folders.

PS : if you wanted to relocate all of $SPLUNK_HOME. the trick is to edit the etc/splunk-launch.conf to give it a new path.

PS : as the $SPLUNK_DB is a default, it may be used for many indexes (and apps), you can verify if you missed something after a restart (the missing folders will be recreated)

0 Karma

ejwade
Contributor

Thanks, @yannK. I was able to delete folders with no issues.

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...