Deployment Architecture

DISABLED-rb in colddb, date quite fresh, still free space volume, when it happened with disabled_rb and disabled_db

mxyy31ruth
Loves-to-Learn Lots

Anyone has ideas about this problem, I am not sure in which situation it will create disabled_rb in /colddb. Any documentation about this kinds of buckets?

0 Karma

DaMu
Observer

I spotted these files too, did you ever find a(n easy) fix? Looking to remove them but not sure 🙂

 

0 Karma

DaMu
Observer

Replying to myself after having had contact with support.

Issue here is probably a large difference between disk space and configured data retention.

Meaning the retention setting is much larger than the disk space will allow. 

Configuring the retention period to be closer to reality should be the fix.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...