disk filling with spool dbmon dbmonevt files

[bgstein]

Among other struggles with DB Connect I'm trying to pull a large amount of historical data into Splunk to see it is possible to migrate a mysql database into Splunk and running into issues with files in dbmon filling the system drive. This is with Splunk (free) running on Windows 2008 R2.

Is it possible to move the dbmon spool via a change to the configuration file? Is there a way to cleanly delete *.dbmonevt files?

Thanks

[araitz]

Many times, this happens because the files have the same checksum for their header and footer. I think you will see events in index=_internal from the fishbucket related to the files in question indicating that they are being skipped because Splunk has already seen them.

[ShaneNewman]

I have never moved the spool to a new location, not to say it is not possible. As far as deleting the events, just shut down splunk, then delete the files from the directory. Make sure you disable the input from dbx that is filling up your drive before restarting splunk.

[bgstein]

Thanks, that allows me to continue.

It is a shame that you can't manage the size of the spool directory as you can the indexes.