All Apps and Add-ons

Just installed DBX v2, what is rsCache.data used for?

lagnone_splunk
Splunk Employee
Splunk Employee

I just installed DBX v2 and noticed a new file called rsCache.data is growing in size.

1) What are the normal size ranges for this file?

2) Is there a configure setting to keep this file at a certain file size?

3) Does a continuous growth in this file means I am pulling more DBX v2 data than it can index?

4) And if I need to remove this file, is it safe to:
a) stop Splunk
b) remove file
c) start Splunk

Tags (1)
1 Solution

jwelch_splunk
Splunk Employee
Splunk Employee

It is a JCS cache file that we use for lookup caching:
https://commons.apache.org/proper/commons-jcs/

1) it depends on how big the foreign table is
2) yes (note:There are plans to expose more of this in splunk in the future.)
a. copy /opt/splunk/etc/apps/splunk_app_db_connect/default/cache.ccf in ../local/cache.ccf
b. Docs can be found here for config options:
https://commons.apache.org/proper/commons-jcs/BasicJCSConfiguration.html
c. restart splunk
3) it probably means you have a large table and we are incurring cache misses
4) yes

View solution in original post

jwelch_splunk
Splunk Employee
Splunk Employee

It is a JCS cache file that we use for lookup caching:
https://commons.apache.org/proper/commons-jcs/

1) it depends on how big the foreign table is
2) yes (note:There are plans to expose more of this in splunk in the future.)
a. copy /opt/splunk/etc/apps/splunk_app_db_connect/default/cache.ccf in ../local/cache.ccf
b. Docs can be found here for config options:
https://commons.apache.org/proper/commons-jcs/BasicJCSConfiguration.html
c. restart splunk
3) it probably means you have a large table and we are incurring cache misses
4) yes

Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...