I have quite a few hot db and warm in one of my index - sharp. Can I delete the files under the rawdata directory like the journal.gz to clean up some space?
Um yes, it is definitely going to impact things. The journal is part of how Splunk stores and makes data searchable. If you start deleting this or other files in the index directories Very Bad Things start happening.
To free up space on that index you can set the maximum size for the index to a smaller value. Then Splunk will clean up old stuff without breaking buckets.
