Change the splunk index database location
In this post, we are covering the procedure to change the location of splunk index database.
Splunk gives you the option to move the index database from one location to another, the default location of splunk database is $SPLUNK_HOME/var/lib/splunk . You can change the location of index database by changing the path definition of SPLUNK_DB through the command-line interface(CLI). Although you can use Splunk Web to change the locations of individual indexes or index volumes, you cannot use it to change the default storage location of indexes, SPLUNK_DB.
CAUTION: Before proceeding , make sure the target file system has at least 1.2 times the size of the total amount of raw data that you are planning to index.
Step i) Create the target directory (on your indexer) with write permissions for the user that Splunk Enterprise runs as. For example, considering splunk runs as a ‘root’ user.
# mkdir /tmp/splunk_db
Step ii) Stop your indexer:
# cd $SPLUNK_HOME/bin # ./splunk stop
Step iii) Copy the index file system to the target directory:
# cp -r $SPLUNK_DB/* /tmp/splunk_db
Below is an image for your further reference,
Step iv) Unset the SPLUNK_DB environment variable:
# unset SPLUNK_DB
Step v) Change the SPLUNK_DB attribute in $SPLUNK_HOME/etc/splunk-launch.conf to specify the new index directory:
# cd /opt/splunk/etc
# vim splunk-launch.conf
NOTE: Don’t forget to remove the ‘#’ preceding to SPLUNK_DB, if you are changing SPLUNK_DB path for the first time.
Step vi) Start the indexer:
# cd $SPLUNK_HOME/bin # ./splunk start
step vii) Verify splunk is able to access the new index database location:
Login to Splunk Web, and create a new index
Go to the new index database and verify,
Kudos!! The splunk indexer starts picking up data from where it left off, using the new location to read/write data.
NOTE: You can delete the old index database once you are sure that the indexer can read and write to the new location.
Thanks for reading, keep following our blog to get more interesting posts related to SPLUNK!!!
Happy Splunking!!
