topic Re: tsidx topologycruncy in Getting Data In

tsidx topologycruncy

baoctac — Mon, 07 Mar 2016 16:18:55 GMT

Sifting through the discussions about tsidx files, I still find myself confused on how these populate. Currently on my search head, there are 25GB in the tsidx/topologyCrunch directory. The only apps I have installed are Splunk App for AWS and Nessus. From the Settings > Report Acceleration Summary, no accelerations are configured.

My questions are: 1) how can i determine where these files are coming from, and 2) how do i go about removing them.

Thanks!

Re: tsidx topologycruncy

jkat54 — Tue, 08 Mar 2016 14:32:01 GMT

Can you give the full path to the folder in question please?

Re: tsidx topologycruncy

baoctac — Tue, 08 Mar 2016 14:34:22 GMT

Hi,
The full path is /opt/splunk/var/lib/splunk/tsidxstats/topologyCronSearch

Thanks.

Re: tsidx topologycruncy

jkat54 — Tue, 08 Mar 2016 18:38:13 GMT

These are coming from a tscollect command in one of your saved searches.

The saved search is probably called "topologyCronSearch".

To remove them, delete the saved search and restart OR disable the saved search and manually delete them from the file system. You should make sure you're not using anything related to the search first though. Most likely, Somewhere there is another search that's looking at these files. Removing the files will cause tstats commands that rely on them to begin failing.

Re: tsidx topologycruncy

baoctac — Thu, 10 Mar 2016 17:25:49 GMT

Awesome! Thanks jkat54. I found a reference under a saved search with the reference to 'namespace=topologyCronSearch'. looks like this search (called Config: Topology Data Generator) was set up alongside the Splunk App for AWS App.

Re: tsidx topologycruncy

piebob — Thu, 10 Mar 2016 18:50:30 GMT

if this answered your question, please 'accept' it 🙂

Re: tsidx topologycruncy

baoctac — Thu, 10 Mar 2016 18:57:12 GMT

Done. Thanks!