Question regarding .tsidx and journal.gz file

[sunnyparmar]

Hi,

I have Splunk installed on Linux and my /data directory is going to full very soon and on further findings what i have found is that .tsidx and journal.gz files are taking lots of space in directory so is there any harm if i will delete these files or is there any other way to get rid of these files.

Thanks in advance

[renjith_nair · Accepted solution]

journal is your compressed raw data and tsidx are your index files. In other terms, these constitute your splunk data. It's not advisable to delete these files manually but adjust your frozenTimePeriodInSecs and maxTotalDataSizeMB in indexes.conf to delete old data from splunk.

Details about data retention is here : http://docs.splunk.com/Documentation/Splunk/5.0/Indexer/Setaretirementandarchivingpolicy

[sunnyparmar]

thanks.. got it..