Documentation > Splunk > Admin Manual > Move an index

Admin Manual

 


Welcome
What to do first
Start Splunk
Meet Splunk Web and Splunk Apps
Before you configure
Add data and configure inputs
Indexing and event processing
Timestamps
Add and manage users
Manage indexes
Define alerts
Set up backups and retention policies
Configure data security
Set up forwarding and receiving
Deploy to other Splunk instances
Set up distributed search
Manage search jobs
Use Splunk's command line interface (CLI)
Configuration file reference
Troubleshooting

Move an index

This documentation does not apply to the most recent version of Splunk. Click here for the latest version.

Contents

Move an index

Move your Splunk index from one location to another.

Caution: Do not try to break up and move parts of an index manually. If you must subdivide an existing index, contact Splunk Support for assistance.

Configuration

1. Make sure the target filesystem has enough space - at least 1.2 times the size of the total amount of raw data you plan to index.

2. Make sure the target directory has the correct permissions so that the splunkd process can write to files there. 

# mkdir /foo/bar
# chown splunk /foo/bar/
# chmod 755 /foo/bar/

3. When the new index home is ready, stop Splunk (if it is running) from Splunk's CLI.

To use Splunk's CLI, navigate to the $SPLUNK_HOME/bin/ directory and use the ./splunk command. 

# ./splunk stop

4. Copy the existing index filesystem to its new home. 

# cp -r $SPLUNK_DB/* /foo/bar/

5. Edit ./etc/splunk-launch.conf to reflect the new index directory.

6. Inside ./etc/splunk-launch.conf, change the SPLUNK_DB variable to point to your new index directory. 

SPLUNK_DB=/foo/bar

7. Start the server. 

# ./splunk start

The Splunk Server picks up where it left off, reading from and writing to the new copy of its old index filesystem.

Once you have moved the index, you can safely delete the old directory and its remaining contents. .

Retrieved from "http://docs.splunk.com/Documentation/Splunk/4.0/Admin/Moveanindex"

This documentation applies to the following versions of Splunk: 4.0 , 4.0.1 , 4.0.2 , 4.0.3 , 4.0.4 , 4.0.5 , 4.0.6 , 4.0.7 , 4.0.8 , 4.0.9 , 4.0.10 , 4.0.11 View the Article History for its revisions.


You must be logged into splunk.com in order to post comments. Log in now.

Was this documentation topic helpful?

If you'd like to hear back from us, please provide your email address:

We'd love to hear what you think about this topic or the documentation as a whole. Feedback you enter here will be delivered to the documentation team.