All Apps and Add-ons

tsidxstats is filling up for the Search Activity app

SCGvdPal
New Member

We've installed the "Search activity" on our Monitoring Console. However, due to a couple of tscollect commands the tsidxstats directory is filling up rapidly, causing the monitoring console to crash. We now remove the files using a cronjob, but is there a cleaner way to resolve this issue?
We use the 2.2.12 version of this app, but an upgrade to 3.0.1 had a few other unexpected and unwanted consequences and we therefore reverted back to the 2.2.12 version.
The directory that is filling up is /opt/splunk/var/lib/splunk/tsidxstats.

0 Karma

codebuilder
Influencer

Move your SPLUNK_DB to another disk (SAN or virtual) and away from the OS disk.

You can change this within /opt/splunk/etc/splunk-launch.conf.

----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma
Get Updates on the Splunk Community!

Introducing New Splunkbase Governance!

Splunk apps are essential for maximizing the value of your Splunk Experience. Whether you’re using the default ...

Splunk Edge Processor | Popular Use Cases to Get Started with Edge Processor

Splunk Edge Processor offers more efficient, flexible data transformation – helping you reduce noise, control ...

3 Ways to Make OpenTelemetry Even Better

My role as an Observability Specialist at Splunk provides me with the opportunity to work with customers of ...