Deployment Architecture

How do I move all log data to another filesystem?

tcp97b
New Member

Currently Splunk is installed in /opt/splunk, the data is in /opt/splunk/var/lib/splunk as it defaults to. I have a 280G partition that I would like to move the current data and have all future data get logged to. What is the best way to make this move?

Tags (2)
0 Karma

dwaddle
SplunkTrust
SplunkTrust

Copy the data using OS utilities WHILE SPLUNK IS DOWN. Easiest way is probably using tar similar to as follows:

/opt/splunk/bin/splunk stop
cd /opt/splunk/var/lib
mv splunk splunk.save
mkdir splunk
mount /dev/sdxxxx /opt/splunk/var/lib/splunk
( cd splunk.save ; tar cf - . ) | ( cd splunk ; tar xvf - . )

Yes, that is two tar's piped into each other - very easy way of copying whilst getting permissions and symlinks right...

gfriedmann
Communicator

I prefer
cp -a
as an easier way of copying with permissions and symlinks.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...