On my indexers I have many bundles that are very old (some over 1 year old). What is the best way to configure Splunk to have only the recent bundles?
Thank you @isoutamo , the ones I see on the indexers at - /opt/splunk/var/run/searchpeers/*
Those are search heads search bundles which have sent to indexers when query has done. Basically each query send it. Those could be full bundle or delta if there is no need to send all search KO with query.
Those files have put on separate directories under this. directory. Subdirectory name told which SH or SHC has sent those.
Basically when there are some old directories which SH's you haven't anymore those are safe to remove. But don't remove anything which is still in use!
Basically those should be there in both format xxxxx.delta and xxxxx directory. Delta file is just tar package which are used to transfer those from SH to indexers.
At least I didn't know that there is official instructions how to delete those.
The safest way to do it is to stop spunk then remove those old directories and files. Then just start splunk.
I know that some will use some scripts to remove all than e.g 2-5 latest bundles, but I haven't need to do it by myself.
So if you are lack of disk space you could remove those, but with your own risk! If not then just leave and remove those e.g. when you are updating your splunk version or otherwise shut it down.