If you need to, you can actually transport your Splunk index database or individual indexes (or parts of an index) to entirely new locations.
This process simply involves the following steps:
Stop Splunk.
Copy the files required for the index.
Unset the
Splunk_DBvariable.Reset the
Splunk_DBvariable (by editing the%SPLUNK_HOME%\etc\splunk-launch.conffile).Restart Splunk.
Delete the old index folder/files.
You can change the path to your indexes with Splunk Web; however, this method only affects the data written to the index after the path change is made. Splunk Web should really only be used for setting paths to new indexes, which we discussed earlier in this chapter.