https://community.splunk.com/t5/Getting-Data-In/Is-it-safe-to-delete-bundle-files-from-opt-splunk-var-run-search/m-p/446298#M77615 <P>size of the single .delta file size is around 1.6 GB. Can we still delete the .delta file of this size. </P> Tue, 17 Jul 2018 17:01:58 GMT Hemnaath 2018-07-17T17:01:58Z https://community.splunk.com/t5/Getting-Data-In/Is-it-safe-to-delete-bundle-files-from-opt-splunk-var-run-search/m-p/446296#M77613 <P>Hi All,</P> <P>Currently we have an disk space issue in two of the splunk indexer instances and we have separate volume create for storing the indexed data. We found that /opt/splunk/var/run/search peers is consuming nearly 19 GB of disk space and /opt/splunk/var/lib/ is occupying some where around 15 GB most containing the splunk internal data. </P> <P>Total disk space allotted for 47G 41G 4.1G 91% /opt </P> <P>Question : </P> <P>1) Is it safe to delete the .bundle files from this location for the indexer instances.<BR /> 2) What will be the correct solution to prevent the disk crunch issue in future.</P> <P>kindly guide me on this. </P> Tue, 17 Jul 2018 16:08:54 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-safe-to-delete-bundle-files-from-opt-splunk-var-run-search/m-p/446296#M77613 Hemnaath 2018-07-17T16:08:54Z https://community.splunk.com/t5/Getting-Data-In/Is-it-safe-to-delete-bundle-files-from-opt-splunk-var-run-search/m-p/446297#M77614 <P>yes it is safe to delete the bundles. How big are the bundles a piece? </P> Tue, 17 Jul 2018 16:56:31 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-safe-to-delete-bundle-files-from-opt-splunk-var-run-search/m-p/446297#M77614 CarsonZa 2018-07-17T16:56:31Z https://community.splunk.com/t5/Getting-Data-In/Is-it-safe-to-delete-bundle-files-from-opt-splunk-var-run-search/m-p/446298#M77615 <P>size of the single .delta file size is around 1.6 GB. Can we still delete the .delta file of this size. </P> Tue, 17 Jul 2018 17:01:58 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-safe-to-delete-bundle-files-from-opt-splunk-var-run-search/m-p/446298#M77615 Hemnaath 2018-07-17T17:01:58Z https://community.splunk.com/t5/Getting-Data-In/Is-it-safe-to-delete-bundle-files-from-opt-splunk-var-run-search/m-p/446299#M77616 <P>yes, i would check to make sure you are not unnecessarily replicating apps you don't use and lookups that aren't useful. </P> Tue, 17 Jul 2018 17:05:33 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-safe-to-delete-bundle-files-from-opt-splunk-var-run-search/m-p/446299#M77616 CarsonZa 2018-07-17T17:05:33Z https://community.splunk.com/t5/Getting-Data-In/Is-it-safe-to-delete-bundle-files-from-opt-splunk-var-run-search/m-p/446300#M77617 <P>Hi Carsonza, thanks for your inputs, I had found the issue we had a .csv with size of 661MB and along with other knowledge bundles and it was causing the replication issue. When checked the lookup file and found that it was broken, because the fields in the lookup table are data that is not relevant to ServiceNow. On fixing the lookup issue the .csv file size was reduce to 49 MB and it cleared the space issue. </P> Fri, 27 Jul 2018 12:34:59 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-safe-to-delete-bundle-files-from-opt-splunk-var-run-search/m-p/446300#M77617 Hemnaath 2018-07-27T12:34:59Z https://community.splunk.com/t5/Getting-Data-In/Is-it-safe-to-delete-bundle-files-from-opt-splunk-var-run-search/m-p/446301#M77618 <P>good to hear, if my answer helped you reach this conclusion please accept my answer. </P> Fri, 27 Jul 2018 14:43:06 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-safe-to-delete-bundle-files-from-opt-splunk-var-run-search/m-p/446301#M77618 CarsonZa 2018-07-27T14:43:06Z