Splunk web data usage

[glenngermiathen]

I just took over as Splunk admin at my job and I am still trying to get up to speed, but I see that the server hosting Splunk web is almost out of space. C:\Program Files\Splunk\var\lib\splunk\summarydb\db is using about 130GB of data. What are these files used for and what is the impact of archiving or deleting some of the much older files?

[Ayn]

$SPLUNK_HOME\var\lib\splunk is where Splunk keeps its indexes ("databases" if you will) which keep all data. Deleting those would be roughly equivalent to deleting mysql's .myi and .myd files - you're effectively deleting the data that the system is supposed to be used for keeping track of. summarydb is most likely used for summary indexing. You can read more about what it is here: http://docs.splunk.com/Documentation/Splunk/5.0.2/Knowledge/Usesummaryindexing

To me it sounds like you need to get some info from someone at your company about how your Splunk installation works and how it's used. Blindly deleting the system's data sounds like a recipe for a small/medium/large disaster depending on your situation.