We have only 2 GB of minimum disk space allocated for Splunk universal forwarder and my envirnoment team has asked to reduce the size consumed. I cleared splunk internal logs and also changes limit.conf but i found disk._objects file consuming more space. Is it safe to delete the file. the splunk version we are using is 7.0.0
Can you check,:
The introspection generator add-on iin the forwarder's $SPLUNK_HOME/etc/apps/introspection_generator_addon/local/app.conf,
[install]
state = enabled
You can disable it if you don't want this data.
Refer doc:
http://docs.splunk.com/Documentation/Splunk/7.0.3/Troubleshooting/Whatdatagetslogged
Can you check,:
The introspection generator add-on iin the forwarder's $SPLUNK_HOME/etc/apps/introspection_generator_addon/local/app.conf,
[install]
state = enabled
You can disable it if you don't want this data.
Refer doc:
http://docs.splunk.com/Documentation/Splunk/7.0.3/Troubleshooting/Whatdatagetslogged
But does it cause any harm to the forwarder like if we clear fish bucket data, the forwarder will re-index the past stuff, similarly if we remove those files, does it cause any issue.
thanks for your support
According to doc it is disabled by default. In your environment those log may enabled for troubleshooting purpose. But yes you can disable it.