We started seeing .dat files for all the indexes since 4th of august at the following path: /opt/splunk/var/lib/splunk
This is where the cold to frozen is pointed to.
There are no changes or upgrades on the server. Is anything wrong with the configurations?
It seems to be just fine as I see these tiny files as well and they hold numbers.
_thefishbucket.dat holds a zero in my case, maybe the number of buckets.. ?
We can see an old refrefence (from 04/03/15) to these *.dat files at Why do I only see the current day's results in searches and should all files in /opt/splunk/var/lib/...
It says -
-- I'm a total splunk newbie, and I inherited a splunk server running on Red Hat Enterprise Linux 5. The other day, I did a reboot of the system. Since then, I can only view the current day's data when I run a search. The version of splunk is 5.0.9. Build 213964 Platform linux x86_64. The splunkd service is running as root, but when I look in
/opt/splunk/var/lib/splunk, I see that all the files except for the ones ending in .dat are owned by splunk:splunk. The .dat files are owned by root:root. Should they all be owned by root?