The TA has bin/splencore.sh which runs every 15mins to look for files older than 12 hours and removes them. This relies on the base path to be setup correctly. However, it wasn't setup correctly as per the install. I had to update SPLUNK_HOME in the script to correct path. basepath="$SPLUNK_HOME/etc/apps/TA-eStreamer/bin/encore/
Even then it doesn't seem to clean the old files. However, manually running the script cleans the files. Is this a known issue?