Documentation: 3.2.3
|  Print Version Contents
This page last updated: 04/22/08 05:04pm

Move an index

Move your Splunk index from one location to another.

Caution: Do not try to break up and move parts of an index filesystem manually. If you need to subdivide an existing index, contact Splunk Support for assistance.

Configuration

1. Make sure the target filesystem has enough space - at least 1.2 times the size of the total amount of raw data you plan to index.

2. Make sure the target directory has the correct permissions so that the splunkd process can write to files there.

# mkdir /foo/bar
# chown splunk /foo/bar/
# chmod 755 /foo/bar/

3. When the new index home is ready, stop the server (if it is running) from Splunk's CLI.
To use Splunk's CLI, navigate to the $SPLUNK_HOME/bin/ directory and use the ./splunk command. Or add Splunk to your path and use the splunk command.

# ./splunk stop

4. Copy the existing index filesystem to its new home.

# cp -r $SPLUNK_DB/* /foo/bar/

5. Edit ./etc/splunk-launch.conf to reflect the new index directory.

6. Inside ./etc/splunk-launch.conf, change the SPLUNK_DB variable to point to your new index directory.

SPLUNK_DB=/foo/bar

Note: Ensure that the path $SPLUNK_HOME/var/lib/splunk/searches exists. Splunk saves a small amount of index data here and without it your index may appear to vanish.

7. Start the server.

# ./splunk start

The Splunk Server picks up where it left off, reading from and writing to the new copy of its old index filesystem.

Previous: Remove (delete) data    |    Next: Set retirement policy

Comments

No comments have been submitted.

Log in to comment.