Knowledge Management
Highlighted

what does these files from searchhead mean?

Explorer

Hi,

What does these files mean. 

In dir /opt/splunk

1.5M    rsa_scheduler__nobody_U3BsdW5rX1NBX0NJTQ__RMD5ba43509e6e89712f_at_1593296280_9250_98A434A0-EF12-4A03-865F-58FC89DB3621
1.5M    scheduler__nobody_U0EtSWRlbnRpdHlNYW5hZ2VtZW50__RMD5f155b8fe52024c5b_at_1593277800_8402_D42B43D6-7CD8-49F4-8960-5743B7FBF310

 

Thanks. 

 

0 Karma
Highlighted

Re: what does these files from searchhead mean?

Communicator

@Reethika 

Did you find these in dispatch directory (/opt/splunk/var/run/splunk/dispatch)? These are search artifacts. whenever you run search (either saved OR adhoc) it created these artifacts on the same node. 

when the job expires these artifacts gets deleted.

Highlighted

Re: what does these files from searchhead mean?

Builder

Whenever search runs it creates search artifacts in  $SPLUNK_HOME/var/run/splunk/dispatch

"scheduler__nobody_U0EtSWRlbnRpdHlNYW5hZ2VtZW50" is created by scheduled search in SA-IdentityManagement (decoded from base64 of U0EtSWRlbnRpdHlNYW5hZ2VtZW50)

Another one starting with "rsa_scheduler__nobody_U3BsdW5rX1NBX0NJTQ" is replicated search artifacts for the sched search, "scheduler__nobody_U3BsdW5rX1NBX0NJTQ_..." according to your shclustering replication_factor.

 

Highlighted

Re: what does these files from searchhead mean?

Explorer

Thanks @sylim_splunk  @anilchaithu 

In times of high disk utilization, can we delete them manually? Is it recommended? 

0 Karma
Highlighted

Re: what does these files from searchhead mean?

New Member

Ophthalmological diseases such as cataract, glaucoma, age-related macular degeneration (AMD), presbyopia, dry eye disease (DED), ocular allergy and others can lead to visual impairment and blindness. Development of therapeutic strategies for ophthalmological diseases requires a comprehensive understanding of the etiology, molecular and anatomical pathogenic mechanisms and natural history of the disease.

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.