Getting Data In

How can I clean up "$splunk_home/var/run/searchpeers" on indexer?

locose
Path Finder

Is there a process to clean up $splunk_home/var/run/searchpeers directory on my indexers? I see *.delta files there from 2 years ago.

kamal_jagga
Contributor

I am also facing same issue ? Indexer is down for few days. A;ready tried dispatch cleanup. Not sure what to do

0 Karma

divyavikas123
Explorer

Hi locose ,
You can delete the older searchpeers,but you first need to stop splunk,and than delete and than start it.As searchpeer contains knowledge objects,and if those knowledge objects are still in use by your search heads(saved searches) than it will be replicated to indexers in the form of search bundles,So if you are having knowledge objects in search heads than u can delete it from search heads.So that next it wont get replicated to indexers.Ask me any query if not get fixed.

Thank you.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...