Can I safely remove old tsidx files and/or the db_xxxxxxxxxx_xxxxxxxxxx_x directories?

[buckml]

I have a machine that is getting low on disk space. Most of the space is being taken by files in the

/opt/splunk/var/lib/splunk/<index>/db 

directory. There are many directories named db_xxxxxxxxxx_xxxxxxxxxx_xx which contain data. Many of these are old with some being over two years old. Can these directories be safely removed? Or, can some of the tsidx files within these directories be safely removed?

[s2_splunk]

What are your data retention settings for these indices? tsidx files are aged out along with the data buckets based on your retention settings (time & disk space based).
I would adjust frozenTimePeriodInSecs and maxDataSize to meet your needs and restart your indexer. It will remove anything that no longer meets your new retention settings.
See here for more details.