I am in need of migrating the splunk folder(/opt/splunk/var/lib/splunk) to another LVM as the current file system is getting filled up. This folder has db and some other files.
Any suggestions or steps?
Found this but steps are not refined - https://answers.splunk.com/answers/3390/how-do-i-move-all-log-data-to-another-filesystem.html
The answer from that other post is quite concise, and describes the steps to take if you're going to use a mount to present the new volume.
If you want to move the data to a different path:
Stop Splunk
Copy the contents of $SPLUNK_HOME/var/lib/splunk to your new location.
(You can use @dwaddle's suggested approach of using tar, or cp/rsync or anything else which robustly copies the data, but pay attention to permissions)
Update the path in your indexes.conf to reflect the new data locations.
Start Splunk
This is what I followed to get this migrated.
Stop the splunk : service splunk stop
Run the below command : rsync -av /opt/splunk/var/lib/ /splunk_data_vol/
Take a backup of /opt/splunk/etc/splunk-launch.conf
Override the new $SPLUNK_DB path /splunk_data_vol/splunk under /opt/splunk/etc/splunk-launch.conf
Start the splunk : service splunk start
The answer from that other post is quite concise, and describes the steps to take if you're going to use a mount to present the new volume.
If you want to move the data to a different path:
Stop Splunk
Copy the contents of $SPLUNK_HOME/var/lib/splunk to your new location.
(You can use @dwaddle's suggested approach of using tar, or cp/rsync or anything else which robustly copies the data, but pay attention to permissions)
Update the path in your indexes.conf to reflect the new data locations.
Start Splunk
@nickhillscpl Thanks! Will try this and update over here.