How long should bundle tar files persist in the search head? Can the space used be limited?

[mzorzi]

The disk space use on our search head is going up significantly. I would seem that *.bundle files in $SPLUNK_HOME/var/run/ directory are being created but are never deleted. Some of them are almost 2 months old. At the moment they take more than 2.5 GB of space.

Why this files are not automatically cleared and is there any way to setup splunk to do it? If there is no configuration option is it safe to remove old file manually?

[jrodman · Accepted solution]

The replication bundles are currently not reaped at all, leading to the situation you see.

I have filed a bug to have this changed. Currently, yes deleting older versions of a given app should be safe. Deleting the newest may not produce good results.

Simpler fix:

splunk stop
rm var/run/*.bundle
splunk start

Incidentally, we've a fix checked in for a future release, probably 4.1.2.

[jrodman]

The search head has to generate the distributed search bundles in order to have them transmitted to the distributed search nodes. It could do this in memory, but storing them on disk is a pretty reasonable 'cache' location for them -- it persists nicely.

[gkanapathy]

I guess a search head wouldn't have search bundles on it.

[gkanapathy]

Is this deployment server bundles, or are these distributed search bundles? search bundles can be quite large, and include CSV lookup tables. In early 4.0 there was a bug where distributed search files were not getting cleaned up, but I have observed them being cleaned up in all recent versions.