Getting Data In

Moved indexed data to different mount - not seeing it

omuelle1
Communicator

Hi,

I was running out of space due to large volume of vmware data that we are indexing and I had to move the data to a different mount. I changed in index.conf where the data is being indexed and moved all the db folders (hot,warm,cold) and hot folders to the new mount as well. However when running a search the old data is being ignored, can you somehow force the index to reindex data it already indexed before?

Oliver

0 Karma

woodcock
Esteemed Legend

I am sure that you meant indexes.conf but in any case, you clearly did not move the old files to the directory at the new mount point so it created new files. It can be merged but it is tricky and unsupported. Your simplest option is to figure out where the disconnect is, rename the old index and create 2 entries in indexes.conf and then search against both until the old data ages out and get rid of the old index.

omuelle1
Communicator

Sorry I did mean index.conf, so I want to create a new index and have it index that data?

0 Karma

woodcock
Esteemed Legend

The correct name is indexes.conf so if you used index.conf then that is the problem.

0 Karma

omuelle1
Communicator

I know, just made typo..

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...