All Apps and Add-ons

General DB files question.

uayub
Path Finder

There are files such as db_1350734407_1350313059_152-tmp in the defaultdb/db folder.
What are these files ending in tmp? When a search is performed, it seems the data that is in these files are not indexed. How do I tell splunk to index such files?

Thanks for your assistance.
UA

Tags (3)
1 Solution

Rob
Splunk Employee
Splunk Employee

These are temporary files that are created by the online fsck process when Splunk detects a bad index and tries to restore the buckets for that index. They are essentially, a working copy to use for restoring the index until the index has been restored to a good state. Once the -tmp folder has restored all the data for the working copy, it will then replace the same named folder. This is to ensure that data is not lost while the restoration is running.

Sometimes, these -tmp folders can be left behind if the online fsck process exits ungracefully. Generally, it should be safe to delete the folder as it is only a copy of the same named db_* folder in the same directory. The online fsck tool will simply re-create the -tmp folder if it is needed again.

More info on online fsck can be had here: http://wiki.splunk.com/Check_and_Repair_Metadata

View solution in original post

Rob
Splunk Employee
Splunk Employee

These are temporary files that are created by the online fsck process when Splunk detects a bad index and tries to restore the buckets for that index. They are essentially, a working copy to use for restoring the index until the index has been restored to a good state. Once the -tmp folder has restored all the data for the working copy, it will then replace the same named folder. This is to ensure that data is not lost while the restoration is running.

Sometimes, these -tmp folders can be left behind if the online fsck process exits ungracefully. Generally, it should be safe to delete the folder as it is only a copy of the same named db_* folder in the same directory. The online fsck tool will simply re-create the -tmp folder if it is needed again.

More info on online fsck can be had here: http://wiki.splunk.com/Check_and_Repair_Metadata

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Splunk App Dev Quarterly Roundup: AI, Agents, and Innovation!

Another quarter, another wave of innovation. From complex integrations to pushing the limits ...

Federated Search for Dynamic Data Self Storage Is Now Generally Available on Splunk ...

 Splunk is excited to announce the General Availability of Federated Search for Dynamic Data Self Storage ...

Index This | What has many keys but can’t unlock a door?

July 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...