All Apps and Add-ons

What are the inflight directories in the defaultdb/db

frussell
New Member

on the index server I have a lot of "inflight" directories. Can I delete these files the index is running out of disk space.

inflight-db_1281863647_1281646469_455/ --1281754080-1281646469-317331.tsidx
--1281863647-1281852120-155270.tsidx
--rawdata/
--splunk-autogen-params.dat --1281863647-1281647883-43400.tsidx
--optimize.result
--Sources.data
--splunk_optimize_logs/

Tags (1)
0 Karma

mmcginnis2
Explorer

I've had multiple inflight-db's when I accidentally ran out of storage. The raw-data directory did not copy over so I removed the inflight's from the target, cleared up some space, and performed the transition again.

From Splunk's Blog talking about restoring an Index:

Step 3 – What is an in-flight bucket? When Splunk transitions a bucket from warm to cold, it is considered to be “in-flight”. There is the potential scenario where a bucket has not completely transitioned, specifically if the storage crashed during the move process. You can find these buckets by looking for “in-flight” within the text of the directory name. You should remove the in-flight bucket as well as include this bucket ID as one that must be also copied to the primary storage from the back up location.

Blog post: http://blogs.splunk.com/2012/02/21/restoring-an-index/

Simeon
Splunk Employee
Splunk Employee

Those are directories that contain Splunk index data and are typically being actively written to. If Splunk is not doing anything to these directories, then there is probably something wrong. You should not delete them as you will lose the data within those directories.

Ellen
Splunk Employee
Splunk Employee

If these inflight-db directories still exist when Splunkd is not running, these are considered stale directories and can be safely deleted.

In general, files and directories should not be modified/removed while Splunk is still up and running.

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...