Deployment Architecture

Can I move the cold buckets to a separate disk?

dkeck
Influencer

Hi,

I was thinking about moving the cold buckets to a separate disk.

I found some questions and docs about it but not especially for Index Cluster.

So please help me to understand the steps. Would something like this work?:

  1. Put Master in maintenance mode ( is this necessary?)
  2. For each peer at a time : take it down with ./splunk offline 2.1 Change coldPath in indexes.conf to new path 2.2 copy old cold data to new path 2.3 Start peer up again
  3. Repeat for each peer
  4. Start up Master again

Please provide additional steps, if needed.

Since the Master is down I can not provide the changes in indexes.conf via the bundle, so the configuration differs, is there a way around that?

Would be great if someone could answer this.

Thank you

Regards

David

0 Karma
1 Solution

dkeck
Influencer

Before this will be one of the many unanswered questions I will reply myself:

I did not find a "master plan" for it, but what I did is to age out the cold buckets to frozen. The frozen buckets are already on a different drive. So thats it.

-Close-

View solution in original post

0 Karma

dkeck
Influencer

Before this will be one of the many unanswered questions I will reply myself:

I did not find a "master plan" for it, but what I did is to age out the cold buckets to frozen. The frozen buckets are already on a different drive. So thats it.

-Close-

0 Karma

woodcock
Esteemed Legend

The whole point of maintenance mode is exactly that indexes.conf MUST be non-synchronized. Being in this mode does not stop indexing from happening. The ones that you haven't yet changed willl still be getting new events and rolling buckets to the old volume while you are updating the Indexer that you are doing and vice-versa as you complete the modifications on each Indexer. Be sure to update the indexes.conf on the CM before you take it out of mauntenance mode or you will have a bug mess.

0 Karma

dkeck
Influencer

Thank you but its still not clear to me,

would you recommend to follow this post? guilmxm does not mention maintenance mode:

https://answers.splunk.com/answers/149248/how-to-move-index-from-one-hard-drive-to-another-in-splunk...

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...