Deployment Architecture

Splunk web data usage

glenngermiathen
Path Finder

I just took over as Splunk admin at my job and I am still trying to get up to speed, but I see that the server hosting Splunk web is almost out of space. C:\Program Files\Splunk\var\lib\splunk\summarydb\db is using about 130GB of data. What are these files used for and what is the impact of archiving or deleting some of the much older files?

Tags (2)
0 Karma

Ayn
Legend

$SPLUNK_HOME\var\lib\splunk is where Splunk keeps its indexes ("databases" if you will) which keep all data. Deleting those would be roughly equivalent to deleting mysql's .myi and .myd files - you're effectively deleting the data that the system is supposed to be used for keeping track of. summarydb is most likely used for summary indexing. You can read more about what it is here: http://docs.splunk.com/Documentation/Splunk/5.0.2/Knowledge/Usesummaryindexing

To me it sounds like you need to get some info from someone at your company about how your Splunk installation works and how it's used. Blindly deleting the system's data sounds like a recipe for a small/medium/large disaster depending on your situation.

Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...