topic Re: Question regarding .tsidx and journal.gz file in Getting Data In

Question regarding .tsidx and journal.gz file

sunnyparmar — Sun, 17 Jan 2016 11:19:47 GMT

Hi,

I have Splunk installed on Linux and my /data directory is going to full very soon and on further findings what i have found is that .tsidx and journal.gz files are taking lots of space in directory so is there any harm if i will delete these files or is there any other way to get rid of these files.

Thanks in advance

Re: Question regarding .tsidx and journal.gz file

renjith_nair — Sun, 17 Jan 2016 12:18:34 GMT

journal is your compressed raw data and tsidx are your index files. In other terms, these constitute your splunk data. It's not advisable to delete these files manually but adjust your frozenTimePeriodInSecs and maxTotalDataSizeMB in indexes.conf to delete old data from splunk.

Details about data retention is here : http://docs.splunk.com/Documentation/Splunk/5.0/Indexer/Setaretirementandarchivingpolicy

Re: Question regarding .tsidx and journal.gz file

sunnyparmar — Sun, 17 Jan 2016 12:53:22 GMT

thanks.. got it..