tsidx topologycruncy

[baoctac]

Sifting through the discussions about tsidx files, I still find myself confused on how these populate. Currently on my search head, there are 25GB in the tsidx/topologyCrunch directory. The only apps I have installed are Splunk App for AWS and Nessus. From the Settings > Report Acceleration Summary, no accelerations are configured.

My questions are: 1) how can i determine where these files are coming from, and 2) how do i go about removing them.

Thanks!

[jkat54 · Accepted solution]

These are coming from a tscollect command in one of your saved searches.

The saved search is probably called "topologyCronSearch".

To remove them, delete the saved search and restart OR disable the saved search and manually delete them from the file system. You should make sure you're not using anything related to the search first though. Most likely, Somewhere there is another search that's looking at these files. Removing the files will cause tstats commands that rely on them to begin failing.

[baoctac]

Awesome! Thanks jkat54. I found a reference under a saved search with the reference to 'namespace=topologyCronSearch'. looks like this search (called Config: Topology Data Generator) was set up alongside the Splunk App for AWS App.

[piebob]

if this answered your question, please 'accept' it 🙂

[baoctac]

Done. Thanks!

[jkat54]

Can you give the full path to the folder in question please?

[baoctac]

Hi,
The full path is /opt/splunk/var/lib/splunk/tsidxstats/topologyCronSearch

Thanks.