What are the house keeping activities we can do in Splunk apart from clearing dispatch directory?

[Venkat_16]

Been trying to create a manual for doing a daily house keeping activities on Splunk and Universal forwarder to make the product work better. Please kindly suggest the same

[lloydknight]

Hello @Venkat_16

Housekeeping on Splunk really depends on the activity of what Splunk does on the server.

It could be a splunkd.log that contributes on eating up space on filesystem of a legacy server, a UF that monitors a huge amount of transaction logs as per requirement that contributes to huge spikes/overheads on system resource, changing configurations on limits.conf that exceeds the default/best practice as per documentation which you have to really do it to fulfill the requirement then generates massive internal logs that eats up space and contributes again on the system resource (CPU/Memory) and you create work arounds to correct the performed configuration.

It's really a case to case basis depending on the operation where the you will perform the housekeeping procedures.

Hope it helps!

[gjanders]

Why are you manually cleaning the dispatch directory? I don't do that on either of my current search head clusters...

I wrote my application Alerts For Splunk Admins attempting to detect issues proactively, but the vast majority of my alerts are of course retrospective...(i.e. it happened and some action can/should be taken before the end user notices :)).
However it does help bring to light a variety of issues or potential issues so it might help you here...

[p_gurav]

Refer this best practice doc:
https://wiki.splunk.com/Community:More_best_practices_and_processes