Just installed DBX v2, what is rsCache.data used for?

[lagnone_splunk]

I just installed DBX v2 and noticed a new file called rsCache.data is growing in size.

1) What are the normal size ranges for this file?

2) Is there a configure setting to keep this file at a certain file size?

3) Does a continuous growth in this file means I am pulling more DBX v2 data than it can index?

4) And if I need to remove this file, is it safe to:
a) stop Splunk
b) remove file
c) start Splunk

[jwelch_splunk · Accepted solution]

It is a JCS cache file that we use for lookup caching:
https://commons.apache.org/proper/commons-jcs/

1) it depends on how big the foreign table is
2) yes (note:There are plans to expose more of this in splunk in the future.)
a. copy /opt/splunk/etc/apps/splunk_app_db_connect/default/cache.ccf in ../local/cache.ccf
b. Docs can be found here for config options:
https://commons.apache.org/proper/commons-jcs/BasicJCSConfiguration.html
c. restart splunk
3) it probably means you have a large table and we are incurring cache misses
4) yes